From nobody Wed Jun 17 07:15:20 2026 Received: from mx0b-00082601.pphosted.com (mx0b-00082601.pphosted.com [67.231.153.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 25A1A3A960A; Thu, 23 Apr 2026 18:25:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=67.231.153.30 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776968752; cv=none; b=Gk9In1+B9XD7iEHe8ZAdpPBWnV9ZTibPGtj8pkQs+F7QZ31imkuTCSc7GDI7bFQUI0HTxwvYH2SU/CRLtsmvLO6RjS5h1nrQoF42KfEHOqiBdp//LPWm3NRxlMy4Q09HAyawfmjmONqMOPhiQ2e+rw63+2d0J/vXxQuhOJf/hsw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776968752; c=relaxed/simple; bh=2Kh3WQw1w8i5k2sGtqTS7Vgt/AVxyI1lGB2Rr7Vp51o=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=gkhGDYPSHMDYAiGsd6U2OwaS0Z6i0m6eCK2Y6OQEZ05loMFZmRED1oPLcDIxjWdnSLkylwTmme0xg/1/bo8/TccCEx8vR/sN65BJ/4HuFrruIZudkz6sigIt+TjPJWZmhFeL+JvnRZ/21yzgREb3nOWMrZEq0VwpOjyxWhvTXCU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=meta.com; spf=pass smtp.mailfrom=meta.com; dkim=pass (2048-bit key) header.d=meta.com header.i=@meta.com header.b=djpgkP4F; arc=none smtp.client-ip=67.231.153.30 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=meta.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=meta.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=meta.com header.i=@meta.com header.b="djpgkP4F" Received: from pps.filterd (m0109331.ppops.net [127.0.0.1]) by mx0a-00082601.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 63NH8ebO2084353; Thu, 23 Apr 2026 11:25:37 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=meta.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=s2048-2025-q2; bh=2NsjjNNKB1Sd5FL7ejXy198NJ9GNqDkeoa+SR5kpEdU=; b=djpgkP4FE0uJ jIdwhfAqCez2Y7irRd4FnNXzxpmmQ/dbIwB2kscSX1Cmdy6QroxI/0D+6GRihFn0 ysaDFRVTDHxdXuEV111PoWwyaq4E1pAZa4mqbW6HpJaN+WldcR9X4ETa/y6Yd2PP mg0xXVrgwgJzBBk4yPSxLyTmG5eJrmn1u281gwam2iz0u8SU9kJT1CSu6Oc5B3vf X8R+DBKSiHWohimPK4iFhvv/5fMXrazXI05o7fOYufRguTHjulkdF6wK7nn8wJJ/ WPAjZhHukDiLbhcHolo+kxWQWSQYCFdp+DPhZBeb1eTwhxzpsbbIFh/NHGIFQRqp aihnBd3unA== Received: from maileast.thefacebook.com ([163.114.135.16]) by mx0a-00082601.pphosted.com (PPS) with ESMTPS id 4dpepapmp9-4 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT); Thu, 23 Apr 2026 11:25:37 -0700 (PDT) Received: from localhost (2620:10d:c0a8:fe::f072) by mail.thefacebook.com (2620:10d:c0a9:6f::8fd4) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.2.2562.37; Thu, 23 Apr 2026 18:25:36 +0000 From: Matt Evans To: Alex Williamson , Kevin Tian , Jason Gunthorpe , Ankit Agrawal , Alistair Popple , Leon Romanovsky , Kees Cook , Shameer Kolothum , Yishai Hadas CC: Alexey Kardashevskiy , Eric Auger , Peter Xu , Vivek Kasireddy , Zhi Wang , , , Subject: [PATCH v2 1/3] vfio/pci: Set up bar resources and maps in vfio_pci_core_enable() Date: Thu, 23 Apr 2026 11:25:07 -0700 Message-ID: <20260423182517.2286030-2-mattev@meta.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260423182517.2286030-1-mattev@meta.com> References: <20260423182517.2286030-1-mattev@meta.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-GUID: GtzOfmiZD38WzweTpNfw_eCl_1XRJ-Kb X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNDIzMDE3OSBTYWx0ZWRfX8BfbJtcE23yC Ez33lUSXSAzpiHnYKyLtPJjGV5rmlup2DOSReIdwCAKN8QojHz7m1RCLBqosTtROe+cnYOzfnKG 39cTGDqqqUv9+d7AKyUNmayCwbDv7FjrKCAnZG/yfH8++mT+I4IJMqOMnopgveraQlsLoIq+fsp n8Mw2nNRTsvXZwV+Gl4exLROQzEgsPJrwMfhVqQbOEmO+7uRcUZTYiDANj/w5OgKrHbgfT+iUOJ yvQBlUH4/uP9DHg8bpR9mFkXHLUDgeVVNb5OQtB7kJi+MwcgO/VoCemXkJdhMeql2Yxho6scgiZ PJfKVSNNPonywGtp1ql3PL05O2co20zIqwao/z/W2fL7+YYl8z3/UIGFRB4oKZE7YJlM0/0L7AY IBgAW9Fh98MKXvDVkFLDkcccIriuHE9uw78xWtUgoP7P2CsMnipkPFAxdOA4nIsCbCr6g0Mkv+Q JuRWuGQBXzpuC7hKHtA== X-Proofpoint-ORIG-GUID: GtzOfmiZD38WzweTpNfw_eCl_1XRJ-Kb X-Authority-Analysis: v=2.4 cv=GcknWwXL c=1 sm=1 tr=0 ts=69ea6421 cx=c_pps a=MfjaFnPeirRr97d5FC5oHw==:117 a=MfjaFnPeirRr97d5FC5oHw==:17 a=A5OVakUREuEA:10 a=VkNPw1HP01LnGYTKEx00:22 a=7x6HtfJdh03M6CCDgxCd:22 a=wpfVPzegXHpEFt3DAXn9:22 a=VabnemYjAAAA:8 a=UfQzwJ_779yHtm4POjsA:9 a=gKebqoRLp9LExxC7YDUY:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-04-23_03,2026-04-21_02,2025-10-01_01 Content-Type: text/plain; charset="utf-8" Previously BAR resource requests and the corresponding pci_iomap() were performed on-demand and without synchronisation, which was racy. Rather than add synchronisation, it's simplest to address this by doing both activities from vfio_pci_core_enable(). The resource allocation and/or pci_iomap() can still fail; their status is tracked and existing calls to vfio_pci_core_setup_barmap() will fail in the same way as before. This keeps the point of failure as observed by userspace the same, i.e. failures to request/map unused BARs are benign. Fixes: 7f5764e179c6 ("vfio: use vfio_pci_core_setup_barmap to map bar in mm= ap") Fixes: 0d77ed3589ac0 ("vfio/pci: Pull BAR mapping setup from read-write pat= h") Signed-off-by: Matt Evans --- drivers/vfio/pci/vfio_pci_core.c | 61 +++++++++++++++++++++++++++----- drivers/vfio/pci/vfio_pci_rdwr.c | 29 ++++++--------- include/linux/vfio_pci_core.h | 1 + 3 files changed, 64 insertions(+), 27 deletions(-) diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_c= ore.c index 3f8d093aacf8..c59c61861d81 100644 --- a/drivers/vfio/pci/vfio_pci_core.c +++ b/drivers/vfio/pci/vfio_pci_core.c @@ -482,6 +482,55 @@ static int vfio_pci_core_runtime_resume(struct device = *dev) } #endif /* CONFIG_PM */ =20 +static void __vfio_pci_core_unmap_bars(struct vfio_pci_core_device *vdev) +{ + struct pci_dev *pdev =3D vdev->pdev; + int i; + + for (i =3D 0; i < PCI_STD_NUM_BARS; i++) { + int bar =3D i + PCI_STD_RESOURCES; + + if (vdev->barmap[bar]) + pci_iounmap(pdev, vdev->barmap[bar]); + if (vdev->have_bar_resource[bar]) + pci_release_selected_regions(pdev, 1 << bar); + vdev->barmap[bar] =3D NULL; + vdev->have_bar_resource[bar] =3D false; + } +} + +static void __vfio_pci_core_map_bars(struct vfio_pci_core_device *vdev) +{ + struct pci_dev *pdev =3D vdev->pdev; + int i; + + /* + * Eager-request BAR resources, and iomap; soft failures are + * allowed, and consumers must check before use. + */ + for (i =3D 0; i < PCI_STD_NUM_BARS; i++) { + int ret; + int bar =3D i + PCI_STD_RESOURCES; + void __iomem *io; + + if (pci_resource_len(pdev, i) =3D=3D 0) + continue; + + ret =3D pci_request_selected_regions(pdev, 1 << bar, "vfio"); + if (ret) { + pci_warn(vdev->pdev, "Failed to reserve region %d\n", bar); + continue; + } + vdev->have_bar_resource[bar] =3D true; + + io =3D pci_iomap(pdev, bar, 0); + if (io) + vdev->barmap[bar] =3D io; + else + pci_warn(vdev->pdev, "Failed to iomap region %d\n", bar); + } +} + /* * The pci-driver core runtime PM routines always save the device state * before going into suspended state. If the device is going into low power @@ -568,6 +617,7 @@ int vfio_pci_core_enable(struct vfio_pci_core_device *v= dev) if (!vfio_vga_disabled() && vfio_pci_is_vga(pdev)) vdev->has_vga =3D true; =20 + __vfio_pci_core_map_bars(vdev); =20 return 0; =20 @@ -591,7 +641,7 @@ void vfio_pci_core_disable(struct vfio_pci_core_device = *vdev) struct pci_dev *pdev =3D vdev->pdev; struct vfio_pci_dummy_resource *dummy_res, *tmp; struct vfio_pci_ioeventfd *ioeventfd, *ioeventfd_tmp; - int i, bar; + int i; =20 /* For needs_reset */ lockdep_assert_held(&vdev->vdev.dev_set->lock); @@ -646,14 +696,7 @@ void vfio_pci_core_disable(struct vfio_pci_core_device= *vdev) =20 vfio_config_free(vdev); =20 - for (i =3D 0; i < PCI_STD_NUM_BARS; i++) { - bar =3D i + PCI_STD_RESOURCES; - if (!vdev->barmap[bar]) - continue; - pci_iounmap(pdev, vdev->barmap[bar]); - pci_release_selected_regions(pdev, 1 << bar); - vdev->barmap[bar] =3D NULL; - } + __vfio_pci_core_unmap_bars(vdev); =20 list_for_each_entry_safe(dummy_res, tmp, &vdev->dummy_resources_list, res_next) { diff --git a/drivers/vfio/pci/vfio_pci_rdwr.c b/drivers/vfio/pci/vfio_pci_r= dwr.c index 4251ee03e146..bf7152316db4 100644 --- a/drivers/vfio/pci/vfio_pci_rdwr.c +++ b/drivers/vfio/pci/vfio_pci_rdwr.c @@ -200,25 +200,18 @@ EXPORT_SYMBOL_GPL(vfio_pci_core_do_io_rw); =20 int vfio_pci_core_setup_barmap(struct vfio_pci_core_device *vdev, int bar) { - struct pci_dev *pdev =3D vdev->pdev; - int ret; - void __iomem *io; - - if (vdev->barmap[bar]) - return 0; - - ret =3D pci_request_selected_regions(pdev, 1 << bar, "vfio"); - if (ret) - return ret; - - io =3D pci_iomap(pdev, bar, 0); - if (!io) { - pci_release_selected_regions(pdev, 1 << bar); + /* + * The barmap is now always set up in vfio_pci_core_enable(). + * Some legacy callers use this function to ensure the BAR + * resources are requested, and others to ensure the + * pci_iomap() was done, so check here: + */ + if (bar < 0 || bar >=3D PCI_STD_NUM_BARS) + return -EINVAL; + if (vdev->barmap[bar] =3D=3D 0) return -ENOMEM; - } - - vdev->barmap[bar] =3D io; - + if (!vdev->bar_has_rsrc[bar]) + return -EBUSY; return 0; } EXPORT_SYMBOL_GPL(vfio_pci_core_setup_barmap); diff --git a/include/linux/vfio_pci_core.h b/include/linux/vfio_pci_core.h index 2ebba746c18f..1f508b067d82 100644 --- a/include/linux/vfio_pci_core.h +++ b/include/linux/vfio_pci_core.h @@ -101,6 +101,7 @@ struct vfio_pci_core_device { const struct vfio_pci_device_ops *pci_ops; void __iomem *barmap[PCI_STD_NUM_BARS]; bool bar_mmap_supported[PCI_STD_NUM_BARS]; + bool have_bar_resource[PCI_STD_NUM_BARS]; u8 *pci_config_map; u8 *vconfig; struct perm_bits *msi_perm; --=20 2.47.3 From nobody Wed Jun 17 07:15:20 2026 Received: from mx0a-00082601.pphosted.com (mx0a-00082601.pphosted.com [67.231.145.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 55A553AA4ED; Thu, 23 Apr 2026 18:25:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=67.231.145.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776968752; cv=none; b=AszXDumwjS13l4L2w6MbtXzJ7xB3Z6iuTiN8MYosTHI1QicPAJWcQ76otLdLkSuPfwazBoGSMnWBIdXSdM9c4YbpsLfWJBc0h1o+Lllv+SBWYJA+2kADNBA6r7+9W36NadExfLs1YJqvS5tp9F4BQ7fJKf0iJb68N9zh2ZPe6Cs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776968752; c=relaxed/simple; bh=ShTdoVrnXSyyHN/6OzXuQ0gMCrNZenZCjaudpjrEzb4=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=hR/5ieylVP+G1/pCtohvUYz9md9e7SSEPgyJkFK1euKLP4Zk5VEzyjGDi/seaWv9zhVdouA1r+0UnTXqJqafzb9vuX4p7+8M18hRXal449qML7CixqTsPk7pSSiNtRp0zLdf+6oYHuK3QlbfzBKQluTIY1JuXoLFpmeEtYgbVgI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=meta.com; spf=pass smtp.mailfrom=meta.com; dkim=pass (2048-bit key) header.d=meta.com header.i=@meta.com header.b=qANomHpC; arc=none smtp.client-ip=67.231.145.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=meta.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=meta.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=meta.com header.i=@meta.com header.b="qANomHpC" Received: from pps.filterd (m0044010.ppops.net [127.0.0.1]) by mx0a-00082601.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 63NH8gUo1824977; Thu, 23 Apr 2026 11:25:41 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=meta.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=s2048-2025-q2; bh=eHQ9GnvNFf670vtjNqDNc3lfQUALdkZNgnI9jY47VFs=; b=qANomHpCq9lk pvgxbW/ckFyijJ/D2M93/5Bix1a+tX3xKV/a+9JbqmeLNt5vn+1Jf2aREQ0zZXad VvXLdtx8OSK/BxpXhf2Vbuqtm5L2D4zHG8iPmwXj0f0hG2l4ZrznbdZvByd14e8r KnUBdofXjwJlLy+Ic9U/aqj4tTJJ7HgmGaFIzUS6krYqQGGFihelK/aIr+uk7NMS lRgzUwp76daXivr2K+uEiI5wSOWX8IRUJqD5rd/xCEqHwxm289jaakMGr91oW3Df 7Do5HP1OzQ06Uzmvr7r3Eei3euTQ53rbbhhQGDCD/O1lZ+KtSzRYYAdjWDF54AZc M8HuUvzTWA== Received: from maileast.thefacebook.com ([163.114.135.16]) by mx0a-00082601.pphosted.com (PPS) with ESMTPS id 4dpeph6qc5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT); Thu, 23 Apr 2026 11:25:40 -0700 (PDT) Received: from localhost (2620:10d:c0a8:1c::1b) by mail.thefacebook.com (2620:10d:c0a9:6f::237c) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.2.2562.37; Thu, 23 Apr 2026 18:25:39 +0000 From: Matt Evans To: Alex Williamson , Kevin Tian , Jason Gunthorpe , Ankit Agrawal , Alistair Popple , Leon Romanovsky , Kees Cook , Shameer Kolothum , Yishai Hadas CC: Alexey Kardashevskiy , Eric Auger , Peter Xu , Vivek Kasireddy , Zhi Wang , , , Subject: [PATCH v2 2/3] vfio/pci: Replace vfio_pci_core_setup_barmap() with checks for resource/map Date: Thu, 23 Apr 2026 11:25:08 -0700 Message-ID: <20260423182517.2286030-3-mattev@meta.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260423182517.2286030-1-mattev@meta.com> References: <20260423182517.2286030-1-mattev@meta.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNDIzMDE3OSBTYWx0ZWRfX78vSNFoKBhZ/ E+cJipjXzBJPB+DUYY6HyohNmZ6VBzW+KswcOsjbJu2sMwWpOerRMsWzLchC/ZSfL/TfAh3bqCV 9eFjl/hKjfkJLuiOMpwsSDGF/vJ9IcenVX5CGMHVMfxVBSqcK67u77AxmBFEATrNQvYQPt6KBnh gbWl66ymifx/Ir9alG2JOBTV+jD4Y/gNcCbLOH9kmkkSEDAGFbd9n7eAH/9+6BSnV4FlXG3eCX/ 2hWehr+sjAWeVa2acyrRT2axe4n3ebQeGElI0NItMU9wdqRmR4TE/h4TAClGfKFjhP/6rAyrMZO C9m60GLp3oFdhPuVy+JZJz6vIOHGPeZ4NegySVYPi46TD4NyyaunuWAhyI80wHCk2889yi0EjpM qndHBwu38LO6tv6P34gKLF90NGBfa+xo8xpfVIBSzmB6mJtyT0jt139LMiNbkboN7AJherbO/0A nRnWQ6oHGmw20aItHkg== X-Proofpoint-GUID: j9Gm2rLmvaJpt0TfjKBY7Sd1IZkXMObo X-Proofpoint-ORIG-GUID: j9Gm2rLmvaJpt0TfjKBY7Sd1IZkXMObo X-Authority-Analysis: v=2.4 cv=B8SJFutM c=1 sm=1 tr=0 ts=69ea6425 cx=c_pps a=MfjaFnPeirRr97d5FC5oHw==:117 a=MfjaFnPeirRr97d5FC5oHw==:17 a=A5OVakUREuEA:10 a=VkNPw1HP01LnGYTKEx00:22 a=7x6HtfJdh03M6CCDgxCd:22 a=8elwO82fXORLTBIkMd32:22 a=VabnemYjAAAA:8 a=80U-LRJ5Y8gpQoc0E0sA:9 a=gKebqoRLp9LExxC7YDUY:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-04-23_03,2026-04-21_02,2025-10-01_01 Content-Type: text/plain; charset="utf-8" Since "vfio/pci: Set up barmap in vfio_pci_core_enable()", the resource request and iomap for the BARs was performed early, and vfio_pci_core_setup_barmap() now just checks those actions succeeded. There were two types of callers: - Those that need the iomap, because they'll access the BAR - Those that need the resource, because they'll map/export it This replaces vfio_pci_core_setup_barmap() with two helpers, vfio_pci_core_check_barmap_valid() and vfio_pci_core_check_bar_rsrc(), to make it clear which behaviour is required in each caller. Signed-off-by: Matt Evans --- drivers/vfio/pci/nvgrace-gpu/main.c | 8 +++----- drivers/vfio/pci/vfio_pci_core.c | 5 ++--- drivers/vfio/pci/vfio_pci_rdwr.c | 22 ++-------------------- drivers/vfio/pci/virtio/legacy_io.c | 4 ++-- include/linux/vfio_pci_core.h | 23 ++++++++++++++++++++++- 5 files changed, 31 insertions(+), 31 deletions(-) diff --git a/drivers/vfio/pci/nvgrace-gpu/main.c b/drivers/vfio/pci/nvgrace= -gpu/main.c index fa056b69f899..d5f09144ac84 100644 --- a/drivers/vfio/pci/nvgrace-gpu/main.c +++ b/drivers/vfio/pci/nvgrace-gpu/main.c @@ -184,12 +184,10 @@ static int nvgrace_gpu_open_device(struct vfio_device= *core_vdev) =20 /* * GPU readiness is checked by reading the BAR0 registers. - * - * ioremap BAR0 to ensure that the BAR0 mapping is present before - * register reads on first fault before establishing any GPU - * memory mapping. + * Ensure that the BAR0 mapping is present before that + * happens. */ - ret =3D vfio_pci_core_setup_barmap(vdev, 0); + ret =3D vfio_pci_core_check_barmap_valid(vdev, 0); if (ret) goto error_exit; =20 diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_c= ore.c index c59c61861d81..2771d0f21899 100644 --- a/drivers/vfio/pci/vfio_pci_core.c +++ b/drivers/vfio/pci/vfio_pci_core.c @@ -1804,10 +1804,9 @@ int vfio_pci_core_mmap(struct vfio_device *core_vdev= , struct vm_area_struct *vma return -EINVAL; =20 /* - * Even though we don't make use of the barmap for the mmap, - * we need to request the region and the barmap tracks that. + * Ensure the BAR resource region is reserved for use. */ - ret =3D vfio_pci_core_setup_barmap(vdev, index); + ret =3D vfio_pci_core_check_bar_rsrc(vdev, index); if (ret) return ret; =20 diff --git a/drivers/vfio/pci/vfio_pci_rdwr.c b/drivers/vfio/pci/vfio_pci_r= dwr.c index bf7152316db4..40c97d73ff95 100644 --- a/drivers/vfio/pci/vfio_pci_rdwr.c +++ b/drivers/vfio/pci/vfio_pci_rdwr.c @@ -198,24 +198,6 @@ ssize_t vfio_pci_core_do_io_rw(struct vfio_pci_core_de= vice *vdev, bool test_mem, } EXPORT_SYMBOL_GPL(vfio_pci_core_do_io_rw); =20 -int vfio_pci_core_setup_barmap(struct vfio_pci_core_device *vdev, int bar) -{ - /* - * The barmap is now always set up in vfio_pci_core_enable(). - * Some legacy callers use this function to ensure the BAR - * resources are requested, and others to ensure the - * pci_iomap() was done, so check here: - */ - if (bar < 0 || bar >=3D PCI_STD_NUM_BARS) - return -EINVAL; - if (vdev->barmap[bar] =3D=3D 0) - return -ENOMEM; - if (!vdev->bar_has_rsrc[bar]) - return -EBUSY; - return 0; -} -EXPORT_SYMBOL_GPL(vfio_pci_core_setup_barmap); - ssize_t vfio_pci_bar_rw(struct vfio_pci_core_device *vdev, char __user *bu= f, size_t count, loff_t *ppos, bool iswrite) { @@ -267,7 +249,7 @@ ssize_t vfio_pci_bar_rw(struct vfio_pci_core_device *vd= ev, char __user *buf, */ max_width =3D VFIO_PCI_IO_WIDTH_4; } else { - int ret =3D vfio_pci_core_setup_barmap(vdev, bar); + int ret =3D vfio_pci_core_check_barmap_valid(vdev, bar); if (ret) { done =3D ret; goto out; @@ -445,7 +427,7 @@ int vfio_pci_ioeventfd(struct vfio_pci_core_device *vde= v, loff_t offset, if (count =3D=3D 8) return -EINVAL; =20 - ret =3D vfio_pci_core_setup_barmap(vdev, bar); + ret =3D vfio_pci_core_check_barmap_valid(vdev, bar); if (ret) return ret; =20 diff --git a/drivers/vfio/pci/virtio/legacy_io.c b/drivers/vfio/pci/virtio/= legacy_io.c index 1ed349a55629..9c59d1600ac4 100644 --- a/drivers/vfio/pci/virtio/legacy_io.c +++ b/drivers/vfio/pci/virtio/legacy_io.c @@ -305,8 +305,8 @@ static int virtiovf_set_notify_addr(struct virtiovf_pci= _core_device *virtvdev) * Setup the BAR where the 'notify' exists to be used by vfio as well * This will let us mmap it only once and use it when needed. */ - ret =3D vfio_pci_core_setup_barmap(core_device, - virtvdev->notify_bar); + ret =3D vfio_pci_core_check_barmap_valid(core_device, + virtvdev->notify_bar); if (ret) return ret; =20 diff --git a/include/linux/vfio_pci_core.h b/include/linux/vfio_pci_core.h index 1f508b067d82..6a5384d57f1d 100644 --- a/include/linux/vfio_pci_core.h +++ b/include/linux/vfio_pci_core.h @@ -189,7 +189,6 @@ int vfio_pci_core_match_token_uuid(struct vfio_device *= core_vdev, int vfio_pci_core_enable(struct vfio_pci_core_device *vdev); void vfio_pci_core_disable(struct vfio_pci_core_device *vdev); void vfio_pci_core_finish_enable(struct vfio_pci_core_device *vdev); -int vfio_pci_core_setup_barmap(struct vfio_pci_core_device *vdev, int bar); pci_ers_result_t vfio_pci_core_aer_err_detected(struct pci_dev *pdev, pci_channel_state_t state); ssize_t vfio_pci_core_do_io_rw(struct vfio_pci_core_device *vdev, bool tes= t_mem, @@ -225,6 +224,28 @@ VFIO_IOREAD_DECLARATION(32) VFIO_IOREAD_DECLARATION(64) #endif =20 +/* Returns 0 if vdev->barmap[bar] can be accessed, otherwise errno */ +static inline int +vfio_pci_core_check_barmap_valid(struct vfio_pci_core_device *vdev, int ba= r) +{ + if (bar < 0 || bar >=3D PCI_STD_NUM_BARS) + return -EINVAL; + if (vdev->barmap[bar] =3D=3D 0) + return -ENOMEM; + return 0; +} + +/* Returns 0 if BAR has a valid resource reserved for use, otherwise errno= */ +static inline int vfio_pci_core_check_bar_rsrc(struct vfio_pci_core_device= *vdev, + int bar) +{ + if (bar < 0 || bar >=3D PCI_STD_NUM_BARS) + return -EINVAL; + if (!vdev->have_bar_resource[bar]) + return -EBUSY; + return 0; +} + static inline bool is_aligned_for_order(struct vm_area_struct *vma, unsigned long addr, unsigned long pfn, --=20 2.47.3 From nobody Wed Jun 17 07:15:20 2026 Received: from mx0b-00082601.pphosted.com (mx0b-00082601.pphosted.com [67.231.153.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ACE9C3AA4FA; Thu, 23 Apr 2026 18:25:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=67.231.153.30 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776968759; cv=none; b=U2vwBSRbYH6ozhOn93eLSlREzwf0/UUYIj+McHZxYSLNtBh1fpcI7DW1E16pLKgmrKiXkko9zHU86t07AxzifVqUsrzggnhqHDHyO+rqAgx5bgpQU0MGw5/9fr0vrSgniYvAKIQU68ZdezPvib9WlPbA3cOcKeKRT+vR0YJefFE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776968759; c=relaxed/simple; bh=MWaaLFpeeq2xR+LuBLxRO6gRPD9oLC6FHTF40PcVw54=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=HAE7dLx2xTxuiOPHCWx9KAuoycsYvYF/YCKnmgAiuvy6bHbgUjW7PlgD5VmK0zLvQk+xO+raN/cDFM7now3sGh5pTfjIh4P9kOpnCYIUi8ZO+UPII4O/yDiyu7pCXz69HRhk4Cqgyy0aZfhiKfJCz3fMg6PT8dKlK9TOg7xG1OQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=meta.com; spf=pass smtp.mailfrom=meta.com; dkim=pass (2048-bit key) header.d=meta.com header.i=@meta.com header.b=JWriJUtS; arc=none smtp.client-ip=67.231.153.30 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=meta.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=meta.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=meta.com header.i=@meta.com header.b="JWriJUtS" Received: from pps.filterd (m0528004.ppops.net [127.0.0.1]) by mx0a-00082601.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 63NH8rSA2691363; Thu, 23 Apr 2026 11:25:43 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=meta.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=s2048-2025-q2; bh=qNvhzshz8buvBXe3D62FiCWxbKMg+r/IzqcfUklWZZI=; b=JWriJUtSYhRI 4sCVTTHNUZikVtRmVGYxClueIfqRNLBaQ4P+8BqVXQ+Vc2K+jcyza6TGJdw8BCs4 xJssA1l9uG1VQL+WOJ4LexuBzR183VGvi5XO88QO8p+0Tq+vwmyz1AmOm7n01oJX Sf+CejS2VTL0c8tXUlsLelm57SF3L1CEQcqkm0zkD7j3BOJJZV/NbRIog19B5ma3 c9onP5c0gQ6ZqQmGu8GuPPJJJW+RPRMz3puKNG/VtFGMO4/t1YcC5wbh4OXdnJ7v Nr/jCStwpyDTsMbrom+hbNzBVXsLHKgiW9w0SiT74+Zs74KhJTX0jyTIx8xijaC8 gUcVn0MMSA== Received: from mail.thefacebook.com ([163.114.134.16]) by mx0a-00082601.pphosted.com (PPS) with ESMTPS id 4dpepdpn0x-4 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT); Thu, 23 Apr 2026 11:25:43 -0700 (PDT) Received: from localhost (2620:10d:c085:108::150d) by mail.thefacebook.com (2620:10d:c08b:78::2ac9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.2.2562.37; Thu, 23 Apr 2026 18:25:42 +0000 From: Matt Evans To: Alex Williamson , Kevin Tian , Jason Gunthorpe , Ankit Agrawal , Alistair Popple , Leon Romanovsky , Kees Cook , Shameer Kolothum , Yishai Hadas CC: Alexey Kardashevskiy , Eric Auger , Peter Xu , Vivek Kasireddy , Zhi Wang , , , Subject: [PATCH v2 3/3] vfio/pci: Check BAR resources before exporting a DMABUF Date: Thu, 23 Apr 2026 11:25:09 -0700 Message-ID: <20260423182517.2286030-4-mattev@meta.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260423182517.2286030-1-mattev@meta.com> References: <20260423182517.2286030-1-mattev@meta.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-GUID: DBnoXmXyPEWZwTE6BsYpZQC0OyYVgKN_ X-Authority-Analysis: v=2.4 cv=Ov9/DS/t c=1 sm=1 tr=0 ts=69ea6427 cx=c_pps a=CB4LiSf2rd0gKozIdrpkBw==:117 a=CB4LiSf2rd0gKozIdrpkBw==:17 a=A5OVakUREuEA:10 a=VkNPw1HP01LnGYTKEx00:22 a=7x6HtfJdh03M6CCDgxCd:22 a=GbPsI2Ihf5RTnMjR_gZv:22 a=VabnemYjAAAA:8 a=Cv6RvFvLZYHFA_XSKfkA:9 a=gKebqoRLp9LExxC7YDUY:22 X-Proofpoint-ORIG-GUID: DBnoXmXyPEWZwTE6BsYpZQC0OyYVgKN_ X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNDIzMDE3OSBTYWx0ZWRfXws+yqIy52B/s toydUSzGVhd/VMlBo1hHPKnuv9QS0zBbMLpvXpKXZ/tUWykUW1N0f99zFm40eBNJR8VjSt4wUGM uCygZr8WJ0SZozFfsJqVCiFYbS0Q8dJoBInHFLRQf1ikFSYz0RLxIO67HJN/989fQLKCACZv/Us Ap+AuSGWc2JOP3TrdKmLsUqP2IX0BMTZ+f47m77Mk0/h2lpTTzFR0jGBcZ0FgPb+gV8N+82wgjg oDcn3WWb9iSJwab0zYA/6rdFrgw+gAI8t7/YC1YZkOmoVFRn8gV6lQp5z8eVZQY5n73PNUIaFHP owuWWQAAeoKvN4XO2oP+FBYmxt2Qg5LsLPUH0LHmmhKrZwBD7ylxuBDEotyhdsveaPXD2hiyLes QDYvxJGh84SHA2H0nZthEjdCh135gZcF5dosr0vS0iuGUWUfw4vsY/dTXsrs9siUIO8Wq3Mh8Xd AX0e6sbBM/ZjPR+zORg== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-04-23_03,2026-04-21_02,2025-10-01_01 Content-Type: text/plain; charset="utf-8" A DMABUF exports access to BAR resources and, although they are requested at startup time, we need to ensure they really were reserved before exporting. Otherwise, it's possible to access unreserved resources through the export. Add a check to the DMABUF-creation path. Fixes: 5d74781ebc86c ("vfio/pci: Add dma-buf export support for MMIO region= s") Signed-off-by: Matt Evans Reviewed-by: Leon Romanovsky --- drivers/vfio/pci/vfio_pci_dmabuf.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/vfio/pci/vfio_pci_dmabuf.c b/drivers/vfio/pci/vfio_pci= _dmabuf.c index f87fd32e4a01..9139198ae270 100644 --- a/drivers/vfio/pci/vfio_pci_dmabuf.c +++ b/drivers/vfio/pci/vfio_pci_dmabuf.c @@ -244,9 +244,11 @@ int vfio_pci_core_feature_dma_buf(struct vfio_pci_core= _device *vdev, u32 flags, return -EINVAL; =20 /* - * For PCI the region_index is the BAR number like everything else. + * For PCI the region_index is the BAR number like everything + * else. Check that PCI resources have been claimed for it. */ - if (get_dma_buf.region_index >=3D VFIO_PCI_ROM_REGION_INDEX) + if (get_dma_buf.region_index >=3D VFIO_PCI_ROM_REGION_INDEX || + vfio_pci_core_check_bar_rsrc(vdev, get_dma_buf.region_index) !=3D 0) return -ENODEV; =20 dma_ranges =3D memdup_array_user(&arg->dma_ranges, get_dma_buf.nr_ranges, --=20 2.47.3