From nobody Tue Jun 16 16:52:38 2026 Received: from mx0b-00082601.pphosted.com (mx0b-00082601.pphosted.com [67.231.153.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 61EE027EFE9; Thu, 30 Apr 2026 10:04:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=67.231.153.30 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777543449; cv=none; b=vEz2vUSX135GObQesrL5sEEci3BH5geIp2gMMKqCCvvxw60trCoO4cb0jBzLBQTbI86dtjTC8y4Sq28H8TZGyHymZNmL1v7HIt8TsakxTE322NGuF5q+HCQzK/2tL5Yh+TS011oaAkMJ9i7Anko720nILPaPEzMOmWLzYZuDLfY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777543449; c=relaxed/simple; bh=tiaqkiNlSh5kxlvQ/zX0MVeZs4mlVA/Xf3/XPXUONHw=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=bSYWYlFrTU/vnc7SzgJN3D+dRnAr1PlWRDaag3u17W2SyQqjuBqiTfLxzix086JB9wDP9u7dRKN2ZDF73ca1qaVyjMhbWWDHYU351sdqJKI1YHbx/6SwWvEF9/yEAYm5aokAsmXyumdb97kj27QO6HGvqZsL7kMaIT5T6zHyoco= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=meta.com; spf=pass smtp.mailfrom=meta.com; dkim=pass (2048-bit key) header.d=meta.com header.i=@meta.com header.b=ipGV1Rfh; arc=none smtp.client-ip=67.231.153.30 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=meta.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=meta.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=meta.com header.i=@meta.com header.b="ipGV1Rfh" Received: from pps.filterd (m0148460.ppops.net [127.0.0.1]) by mx0a-00082601.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 63U2nbjG1981453; Thu, 30 Apr 2026 03:03:52 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=meta.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=s2048-2025-q2; bh=hKh2yyKTwlsM0roCF1ei7q92UuuhNxf8ag6BveBAjpw=; b=ipGV1Rfhz7iZ 3UMuiaaBcnMYGLm0MMVlbxZ485Qoi1D80eDUF6vaUm0Yr89SQVn97eZuqah/Gh/n gT5RZ1ASauuyY0mI3jMKob+WfoBwxVLBp0VvbyJ/l3hScOd0uJ2TGprEIInOyJHb Q3GZPxgjXvOHJo1ZZf01kEAOYv2JYsP7xSlZtDX6DKzmVa0GTLnvHnUkcQGX5iwb IXiUOsBl0mEcWlR7yy5/Mt2Si8RfI36VNHyF5m+zH5stIvoTLkSqsb1LJxCIpK6g FxqLZA7bGXA6b/MtRUMVNbnQeknA3fLpnWA3qDyiD3ILoYHK2uv/X8q/3JLDbWg7 NVlBTDqnEg== Received: from mail.thefacebook.com ([163.114.134.16]) by mx0a-00082601.pphosted.com (PPS) with ESMTPS id 4dru4frcg2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT); Thu, 30 Apr 2026 03:03:52 -0700 (PDT) Received: from localhost (2620:10d:c085:108::150d) by mail.thefacebook.com (2620:10d:c08b:78::2ac9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.2.2562.37; Thu, 30 Apr 2026 10:03:51 +0000 From: Matt Evans To: Alex Williamson , Kevin Tian , Jason Gunthorpe , Ankit Agrawal , Alistair Popple , Leon Romanovsky , Kees Cook , Shameer Kolothum , Yishai Hadas CC: Alexey Kardashevskiy , Eric Auger , Peter Xu , Vivek Kasireddy , Zhi Wang , , , Subject: [PATCH v3 1/3] vfio/pci: Set up bar resources and maps in vfio_pci_core_enable() Date: Thu, 30 Apr 2026 03:03:20 -0700 Message-ID: <20260430100340.2787446-2-mattev@meta.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260430100340.2787446-1-mattev@meta.com> References: <20260430100340.2787446-1-mattev@meta.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-GUID: pksXHTCoc5iXwp3w_zYX22Y0-MY-Bdoe X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNDMwMDEwMCBTYWx0ZWRfX7e/DHJ4dfiDq r2dvxi4+Z0NghzOFAW5UOxQ2WS5gbHuqjH7QPMzHRmVJ8YMuugRH7EH2+FTi6NN4MRiETtDPwJi juYXLWD/RnXhV6kj6lgadDdlk740jmKtFOdeB/tEcoA9Bdup8hyK200t8JE8CKrkvEi41vQsr3L vDiSZMvuicXE1PpeEllGeXseV6yqYXJNkt1zCT0udsE1quXe3YubjieTWDkd3tLQHRqliyB4N3t RI4HsfcZbLfGERozOp5U40FP/Yur/4h2upsHFU1o+UhPBQVmQXMV7937PIIxvzQC9/yv3Ex50T/ M08fTaszQWArRAhK+dO0SXaj3tWEveFin1oev7MescTZeitB3qveOAh2a4oadgX7Dvzfry29Zuo LbXTo5JOPAbYccgz++FiW5JVn5VdVgQiTiKIxHf4Een1431681ax3yJT2eUYctLiDqrFL5rgvTY 584MNSREbJ0a3vqyugg== X-Authority-Analysis: v=2.4 cv=WLdPmHsR c=1 sm=1 tr=0 ts=69f32908 cx=c_pps a=CB4LiSf2rd0gKozIdrpkBw==:117 a=CB4LiSf2rd0gKozIdrpkBw==:17 a=A5OVakUREuEA:10 a=VkNPw1HP01LnGYTKEx00:22 a=7x6HtfJdh03M6CCDgxCd:22 a=JnKecZnUtZousrUlYMGU:22 a=VabnemYjAAAA:8 a=s4PiSZQpilcMNiFIlqwA:9 a=gKebqoRLp9LExxC7YDUY:22 X-Proofpoint-ORIG-GUID: pksXHTCoc5iXwp3w_zYX22Y0-MY-Bdoe X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-04-30_03,2026-04-28_01,2025-10-01_01 Content-Type: text/plain; charset="utf-8" Previously BAR resource requests and the corresponding pci_iomap() were performed on-demand and without synchronisation, which was racy. Rather than add synchronisation, it's simplest to address this by doing both activities from vfio_pci_core_enable(). The resource allocation and/or pci_iomap() can still fail; their status is tracked and existing calls to vfio_pci_core_setup_barmap() will fail in a similar way to before. This keeps the point of failure as observed by userspace the same, i.e. failures to request/map unused BARs are benign. Fixes: 7f5764e179c6 ("vfio: use vfio_pci_core_setup_barmap to map bar in mm= ap") Fixes: 0d77ed3589ac0 ("vfio/pci: Pull BAR mapping setup from read-write pat= h") Signed-off-by: Matt Evans --- drivers/vfio/pci/vfio_pci_core.c | 33 ++++++++++++++++++++++++++++++++ drivers/vfio/pci/vfio_pci_rdwr.c | 29 ++++++++++++---------------- 2 files changed, 45 insertions(+), 17 deletions(-) diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_c= ore.c index 3f8d093aacf8..eab4f2626b39 100644 --- a/drivers/vfio/pci/vfio_pci_core.c +++ b/drivers/vfio/pci/vfio_pci_core.c @@ -482,6 +482,38 @@ static int vfio_pci_core_runtime_resume(struct device = *dev) } #endif /* CONFIG_PM */ =20 +static void vfio_pci_core_map_bars(struct vfio_pci_core_device *vdev) +{ + struct pci_dev *pdev =3D vdev->pdev; + int i; + + /* + * Eager-request BAR resources, and iomap. Soft failures are + * allowed, and consumers must check the barmap before use in + * order to give compatible user-visible behaviour with the + * previous on-demand allocation method. + */ + for (i =3D 0; i < PCI_STD_NUM_BARS; i++) { + int bar =3D i + PCI_STD_RESOURCES; + void __iomem *io =3D ERR_PTR(-ENODEV); + + if (pci_resource_len(pdev, i) > 0) { + if (pci_request_selected_regions(pdev, 1 << bar, "vfio")) { + pci_warn(vdev->pdev, "Failed to reserve region %d\n", bar); + io =3D ERR_PTR(-EBUSY); + } else { + io =3D pci_iomap(pdev, bar, 0); + if (!io) { + pci_warn(vdev->pdev, "Failed to iomap region %d\n", + bar); + io =3D ERR_PTR(-ENOMEM); + } + } + } + vdev->barmap[bar] =3D io; + } +} + /* * The pci-driver core runtime PM routines always save the device state * before going into suspended state. If the device is going into low power @@ -568,6 +600,7 @@ int vfio_pci_core_enable(struct vfio_pci_core_device *v= dev) if (!vfio_vga_disabled() && vfio_pci_is_vga(pdev)) vdev->has_vga =3D true; =20 + vfio_pci_core_map_bars(vdev); =20 return 0; =20 diff --git a/drivers/vfio/pci/vfio_pci_rdwr.c b/drivers/vfio/pci/vfio_pci_r= dwr.c index 4251ee03e146..f66ad3d96481 100644 --- a/drivers/vfio/pci/vfio_pci_rdwr.c +++ b/drivers/vfio/pci/vfio_pci_rdwr.c @@ -200,25 +200,20 @@ EXPORT_SYMBOL_GPL(vfio_pci_core_do_io_rw); =20 int vfio_pci_core_setup_barmap(struct vfio_pci_core_device *vdev, int bar) { - struct pci_dev *pdev =3D vdev->pdev; - int ret; - void __iomem *io; - - if (vdev->barmap[bar]) - return 0; - - ret =3D pci_request_selected_regions(pdev, 1 << bar, "vfio"); - if (ret) - return ret; - - io =3D pci_iomap(pdev, bar, 0); - if (!io) { - pci_release_selected_regions(pdev, 1 << bar); - return -ENOMEM; - } + /* + * The barmap is set up in vfio_pci_core_enable(). Callers + * use this function to check that the BAR resources are + * requested or that the pci_iomap() was done. + */ + if (bar < 0 || bar >=3D PCI_STD_NUM_BARS) + return -EINVAL; =20 - vdev->barmap[bar] =3D io; + /* Did vfio_pci_core_map_bars() set it up yet? */ + if (!vdev->barmap[bar]) + return -ENODEV; =20 + if (IS_ERR(vdev->barmap[bar])) + return PTR_ERR(vdev->barmap[bar]); return 0; } EXPORT_SYMBOL_GPL(vfio_pci_core_setup_barmap); --=20 2.47.3 From nobody Tue Jun 16 16:52:38 2026 Received: from mx0a-00082601.pphosted.com (mx0a-00082601.pphosted.com [67.231.145.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E819E393DD9; Thu, 30 Apr 2026 10:04:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=67.231.145.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777543450; cv=none; b=kW9BJLNrBLYApcLcwS1JUvrx6rbvCFHm/s7CiB7u5JC/hVjzoTNwm5Id2M5ragZjM0IyUqMC20X1BsX8Lu4TsSqiAChawJmgIcjRm6a4rCeciNQy39CGKWWtBwrTjIukEkS0+ijyWATNFir4cdumFYtQDopi4SSP/GeLdGpzBX0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777543450; c=relaxed/simple; bh=aKMUgnhcqf+swiFscohRYZI4ETFq9DrRlhcmFQ4dmb8=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=J1vJ0lcas9iiK750XmkOgvbPw0TBSK/PPtY15o6oQ9ivi9P3kzNgykySPXBubQ2VMSr5jcK/U2276E+SC1+el2JWUd0mHtaF0TdVhMrb29/OJ+fzEZC4DeReg9AYbsTqDcMr02dN4GUCgFiyYaG75c4yTkOho1Yx7CGFj2105N0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=meta.com; spf=pass smtp.mailfrom=meta.com; dkim=pass (2048-bit key) header.d=meta.com header.i=@meta.com header.b=lMhmSv2a; arc=none smtp.client-ip=67.231.145.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=meta.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=meta.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=meta.com header.i=@meta.com header.b="lMhmSv2a" Received: from pps.filterd (m0044012.ppops.net [127.0.0.1]) by mx0a-00082601.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 63U49i4u2006293; Thu, 30 Apr 2026 03:03:54 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=meta.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=s2048-2025-q2; bh=URyqm4DU6tZrmJrdCb8fM6nxg82K496rFtrOAXyE7TU=; b=lMhmSv2azmW3 ZOoeMC9PHYm3C42aOyKInCAoaip5LkA8CxH7tK/F4DTi+ECQFDSX60eOFSQT3L/9 oQSHpPjGeBmY9NR0kWkq/ZntX0tZCKYtHkPXgV5tf36Q5xlw8s1a/paClrsVDi2N xdHYtCswJgKtolNe44CutWrCVIi1JhIEJz8rLC/lZET2qRvKf4Qy/3Vf0hDy7Ff7 Bn83a5NBxTTFa2ZDohziAjrc0lPmn5eEw5pVwa1O19sqO+lBpTg8+/HvS5VMl5uz HjvrOfeZXoeuIZG8AWLfx0hc/BTwnThFQHxI7VpZzttRJA6xa3RfLMLXmPcLUWKR NmwBuIce1w== Received: from maileast.thefacebook.com ([163.114.135.16]) by mx0a-00082601.pphosted.com (PPS) with ESMTPS id 4drua3rcqh-2 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT); Thu, 30 Apr 2026 03:03:54 -0700 (PDT) Received: from localhost (2620:10d:c0a8:fe::f072) by mail.thefacebook.com (2620:10d:c0a9:6f::237c) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.2.2562.37; Thu, 30 Apr 2026 10:03:53 +0000 From: Matt Evans To: Alex Williamson , Kevin Tian , Jason Gunthorpe , Ankit Agrawal , Alistair Popple , Leon Romanovsky , Kees Cook , Shameer Kolothum , Yishai Hadas CC: Alexey Kardashevskiy , Eric Auger , Peter Xu , Vivek Kasireddy , Zhi Wang , , , Subject: [PATCH v3 2/3] vfio/pci: Replace vfio_pci_core_setup_barmap() with vfio_pci_core_get_iomap() Date: Thu, 30 Apr 2026 03:03:21 -0700 Message-ID: <20260430100340.2787446-3-mattev@meta.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260430100340.2787446-1-mattev@meta.com> References: <20260430100340.2787446-1-mattev@meta.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-GUID: myC6x2IFiCLoUii1-c6LPuSgRwaBLGMZ X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNDMwMDEwMCBTYWx0ZWRfX3A/ekz9zFsKQ 34pdcN9uxo5jOzDI6djgHlVPAPMWR4rg9X3/yPUk/c66K29HV8saiq7DpenmalLijJrqgm5vjwj /3sOANAPDsQqeCE9hh8Meu2zSYmM102ZBhwhfTaGWiNIQK+1GcE+4wGnkysDenhe4+ZyEqHibH9 4iUcfy0w/I9Kzx7dT7kmgtttNr78EbAs+uropU7+7rWLAoIkgw6QsZPcTVPL/EaPMb5LH+8jWlK xw0EGYxfUO69SAfyDF9SwlvmEtUdsvuWbXv/NslaxjyNOVsGt7yofMDRoCRIlvrAxXwsiaCKhEP t4KWkse51fSSzhyV3IIZgaWILI9v/eBByGygi67LstIpv4sXCTFo963edi1ensTJUvyEVNemZt5 gCTQQoqfcaTEnhB0R7kIiI/J2soDGxd2d/ujA2+gsGWYNMHCep6FB/ROsQnlJYgq51WDDYqX2nS 8pfHDHDgfnHdPJ2KGag== X-Proofpoint-ORIG-GUID: myC6x2IFiCLoUii1-c6LPuSgRwaBLGMZ X-Authority-Analysis: v=2.4 cv=UYphjqSN c=1 sm=1 tr=0 ts=69f3290a cx=c_pps a=MfjaFnPeirRr97d5FC5oHw==:117 a=MfjaFnPeirRr97d5FC5oHw==:17 a=A5OVakUREuEA:10 a=VkNPw1HP01LnGYTKEx00:22 a=7x6HtfJdh03M6CCDgxCd:22 a=PAz_-FQ8hEVmOPYdF0yf:22 a=VabnemYjAAAA:8 a=YWJoA2wA2ee_WqQzurEA:9 a=gKebqoRLp9LExxC7YDUY:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-04-30_03,2026-04-28_01,2025-10-01_01 Content-Type: text/plain; charset="utf-8" Since "vfio/pci: Set up barmap in vfio_pci_core_enable()", the resource request and iomap for the BARs was performed early, and vfio_pci_core_setup_barmap() just checks those actions succeeded. Move this logic to a new helper that checks success and returns the iomap address, replacing the various bare vdev->barmap[] lookups. This maintains the error behaviour of the previous on-demand vfio_pci_core_setup_barmap() scheme. Signed-off-by: Matt Evans --- drivers/vfio/pci/nvgrace-gpu/main.c | 17 +++++++------ drivers/vfio/pci/vfio_pci_core.c | 11 ++++----- drivers/vfio/pci/vfio_pci_rdwr.c | 37 +++++++---------------------- drivers/vfio/pci/virtio/legacy_io.c | 13 +++++----- include/linux/vfio_pci_core.h | 19 ++++++++++++++- 5 files changed, 47 insertions(+), 50 deletions(-) diff --git a/drivers/vfio/pci/nvgrace-gpu/main.c b/drivers/vfio/pci/nvgrace= -gpu/main.c index fa056b69f899..2f5ec60c15d9 100644 --- a/drivers/vfio/pci/nvgrace-gpu/main.c +++ b/drivers/vfio/pci/nvgrace-gpu/main.c @@ -184,13 +184,11 @@ static int nvgrace_gpu_open_device(struct vfio_device= *core_vdev) =20 /* * GPU readiness is checked by reading the BAR0 registers. - * - * ioremap BAR0 to ensure that the BAR0 mapping is present before - * register reads on first fault before establishing any GPU - * memory mapping. + * The BAR map was just set up by vfio_pci_core_enable() and, + * although the readiness check checks validity of the BAR0 + * map, assert early that the map was successful: */ - ret =3D vfio_pci_core_setup_barmap(vdev, 0); - if (ret) + if (IS_ERR(vfio_pci_core_get_iomap(vdev, 0))) goto error_exit; =20 if (nvdev->resmem.memlength) { @@ -265,6 +263,7 @@ static int nvgrace_gpu_check_device_ready(struct nvgrace_gpu_pci_core_device *nvdev) { struct vfio_pci_core_device *vdev =3D &nvdev->core_device; + void __iomem *io; int ret; =20 lockdep_assert_held_read(&vdev->memory_lock); @@ -275,7 +274,11 @@ nvgrace_gpu_check_device_ready(struct nvgrace_gpu_pci_= core_device *nvdev) if (!__vfio_pci_memory_enabled(vdev)) return -EIO; =20 - ret =3D nvgrace_gpu_wait_device_ready(vdev->barmap[0]); + io =3D vfio_pci_core_get_iomap(vdev, 0); + if (IS_ERR(io)) + return PTR_ERR(io); + + ret =3D nvgrace_gpu_wait_device_ready(io); if (ret) return ret; =20 diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_c= ore.c index eab4f2626b39..feaf894ac118 100644 --- a/drivers/vfio/pci/vfio_pci_core.c +++ b/drivers/vfio/pci/vfio_pci_core.c @@ -1760,7 +1760,7 @@ int vfio_pci_core_mmap(struct vfio_device *core_vdev,= struct vm_area_struct *vma struct pci_dev *pdev =3D vdev->pdev; unsigned int index; u64 phys_len, req_len, pgoff, req_start; - int ret; + void __iomem *bar_io; =20 index =3D vma->vm_pgoff >> (VFIO_PCI_OFFSET_SHIFT - PAGE_SHIFT); =20 @@ -1794,12 +1794,11 @@ int vfio_pci_core_mmap(struct vfio_device *core_vde= v, struct vm_area_struct *vma return -EINVAL; =20 /* - * Even though we don't make use of the barmap for the mmap, - * we need to request the region and the barmap tracks that. + * Ensure the BAR resource region is reserved for use. */ - ret =3D vfio_pci_core_setup_barmap(vdev, index); - if (ret) - return ret; + bar_io =3D vfio_pci_core_get_iomap(vdev, index); + if (IS_ERR(bar_io)) + return PTR_ERR(bar_io); =20 vma->vm_private_data =3D vdev; vma->vm_page_prot =3D pgprot_noncached(vma->vm_page_prot); diff --git a/drivers/vfio/pci/vfio_pci_rdwr.c b/drivers/vfio/pci/vfio_pci_r= dwr.c index f66ad3d96481..7f14dd46de17 100644 --- a/drivers/vfio/pci/vfio_pci_rdwr.c +++ b/drivers/vfio/pci/vfio_pci_rdwr.c @@ -198,26 +198,6 @@ ssize_t vfio_pci_core_do_io_rw(struct vfio_pci_core_de= vice *vdev, bool test_mem, } EXPORT_SYMBOL_GPL(vfio_pci_core_do_io_rw); =20 -int vfio_pci_core_setup_barmap(struct vfio_pci_core_device *vdev, int bar) -{ - /* - * The barmap is set up in vfio_pci_core_enable(). Callers - * use this function to check that the BAR resources are - * requested or that the pci_iomap() was done. - */ - if (bar < 0 || bar >=3D PCI_STD_NUM_BARS) - return -EINVAL; - - /* Did vfio_pci_core_map_bars() set it up yet? */ - if (!vdev->barmap[bar]) - return -ENODEV; - - if (IS_ERR(vdev->barmap[bar])) - return PTR_ERR(vdev->barmap[bar]); - return 0; -} -EXPORT_SYMBOL_GPL(vfio_pci_core_setup_barmap); - ssize_t vfio_pci_bar_rw(struct vfio_pci_core_device *vdev, char __user *bu= f, size_t count, loff_t *ppos, bool iswrite) { @@ -269,13 +249,11 @@ ssize_t vfio_pci_bar_rw(struct vfio_pci_core_device *= vdev, char __user *buf, */ max_width =3D VFIO_PCI_IO_WIDTH_4; } else { - int ret =3D vfio_pci_core_setup_barmap(vdev, bar); - if (ret) { - done =3D ret; + io =3D vfio_pci_core_get_iomap(vdev, bar); + if (IS_ERR(io)) { + done =3D PTR_ERR(io); goto out; } - - io =3D vdev->barmap[bar]; } =20 if (bar =3D=3D vdev->msix_bar) { @@ -430,6 +408,7 @@ int vfio_pci_ioeventfd(struct vfio_pci_core_device *vde= v, loff_t offset, loff_t pos =3D offset & VFIO_PCI_OFFSET_MASK; int ret, bar =3D VFIO_PCI_OFFSET_TO_INDEX(offset); struct vfio_pci_ioeventfd *ioeventfd; + void __iomem *io; =20 /* Only support ioeventfds into BARs */ if (bar > VFIO_PCI_BAR5_REGION_INDEX) @@ -447,9 +426,9 @@ int vfio_pci_ioeventfd(struct vfio_pci_core_device *vde= v, loff_t offset, if (count =3D=3D 8) return -EINVAL; =20 - ret =3D vfio_pci_core_setup_barmap(vdev, bar); - if (ret) - return ret; + io =3D vfio_pci_core_get_iomap(vdev, bar); + if (IS_ERR(io)) + return PTR_ERR(io); =20 mutex_lock(&vdev->ioeventfds_lock); =20 @@ -486,7 +465,7 @@ int vfio_pci_ioeventfd(struct vfio_pci_core_device *vde= v, loff_t offset, } =20 ioeventfd->vdev =3D vdev; - ioeventfd->addr =3D vdev->barmap[bar] + pos; + ioeventfd->addr =3D io + pos; ioeventfd->data =3D data; ioeventfd->pos =3D pos; ioeventfd->bar =3D bar; diff --git a/drivers/vfio/pci/virtio/legacy_io.c b/drivers/vfio/pci/virtio/= legacy_io.c index 1ed349a55629..c868b2177310 100644 --- a/drivers/vfio/pci/virtio/legacy_io.c +++ b/drivers/vfio/pci/virtio/legacy_io.c @@ -299,19 +299,18 @@ int virtiovf_pci_ioctl_get_region_info(struct vfio_de= vice *core_vdev, static int virtiovf_set_notify_addr(struct virtiovf_pci_core_device *virtv= dev) { struct vfio_pci_core_device *core_device =3D &virtvdev->core_device; - int ret; + void __iomem *io; =20 /* * Setup the BAR where the 'notify' exists to be used by vfio as well * This will let us mmap it only once and use it when needed. */ - ret =3D vfio_pci_core_setup_barmap(core_device, - virtvdev->notify_bar); - if (ret) - return ret; + io =3D vfio_pci_core_get_iomap(core_device, + virtvdev->notify_bar); + if (IS_ERR(io)) + return PTR_ERR(io); =20 - virtvdev->notify_addr =3D core_device->barmap[virtvdev->notify_bar] + - virtvdev->notify_offset; + virtvdev->notify_addr =3D io + virtvdev->notify_offset; return 0; } =20 diff --git a/include/linux/vfio_pci_core.h b/include/linux/vfio_pci_core.h index 2ebba746c18f..5598071c5ea3 100644 --- a/include/linux/vfio_pci_core.h +++ b/include/linux/vfio_pci_core.h @@ -188,7 +188,6 @@ int vfio_pci_core_match_token_uuid(struct vfio_device *= core_vdev, int vfio_pci_core_enable(struct vfio_pci_core_device *vdev); void vfio_pci_core_disable(struct vfio_pci_core_device *vdev); void vfio_pci_core_finish_enable(struct vfio_pci_core_device *vdev); -int vfio_pci_core_setup_barmap(struct vfio_pci_core_device *vdev, int bar); pci_ers_result_t vfio_pci_core_aer_err_detected(struct pci_dev *pdev, pci_channel_state_t state); ssize_t vfio_pci_core_do_io_rw(struct vfio_pci_core_device *vdev, bool tes= t_mem, @@ -234,6 +233,24 @@ static inline bool is_aligned_for_order(struct vm_area= _struct *vma, !IS_ALIGNED(pfn, 1 << order))); } =20 +/* + * Returns a BAR's iomap base, or an ERR_PTR() if, for example, the + * BAR isn't valid, its resource wasn't acquired, or its iomap + * failed. + */ +static inline void __iomem __must_check * +vfio_pci_core_get_iomap(struct vfio_pci_core_device *vdev, int bar) +{ + if (bar < 0 || bar >=3D PCI_STD_NUM_BARS) + return ERR_PTR(-EINVAL); + + /* Did vfio_pci_core_map_bars() set it up yet? */ + if (!vdev->barmap[bar]) + return ERR_PTR(-ENODEV); + + return vdev->barmap[bar]; +} + int vfio_pci_dma_buf_iommufd_map(struct dma_buf_attachment *attachment, struct phys_vec *phys); =20 --=20 2.47.3 From nobody Tue Jun 16 16:52:38 2026 Received: from mx0a-00082601.pphosted.com (mx0a-00082601.pphosted.com [67.231.145.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 669853FFAC0; Thu, 30 Apr 2026 10:04:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=67.231.145.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777543452; cv=none; b=Q9X8gjYJvciv3w/Fhb5Pmz55CpCZ+0hefsni8ZlYj5/II83bBv4h8JYwRFWzYiD7HfbRqAs/SvRpLXoxfm5W24zK5luJLBQOktSlpPuoOC/JcvU5TWrTe86VUoaJhAcJW9YTfY+0ErIZuIvnZFDgPh8oXPjz3L19AxVjx/W/Npw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777543452; c=relaxed/simple; bh=1iGbaAKSe1uA8apN3oBgpPr44XSzoe6+bbAM3hi0qYE=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=tYZngqM988+tubQWxkD4ujreOy+PG6r85pjX5VpDLj6FqH6I+pch5/g4ddexFNv8/XG2sxXAfK4L0lX6IxX0lcNOR0fqTWooQvni+Mz2mqKEu6gmTo0dKJENWhQuV5+odebqjU94qN5yAbOqbgo/f3de97TcGswx3P720soKmXo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=meta.com; spf=pass smtp.mailfrom=meta.com; dkim=pass (2048-bit key) header.d=meta.com header.i=@meta.com header.b=YmBIXFu/; arc=none smtp.client-ip=67.231.145.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=meta.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=meta.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=meta.com header.i=@meta.com header.b="YmBIXFu/" Received: from pps.filterd (m0528008.ppops.net [127.0.0.1]) by mx0a-00082601.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 63TFMHjB2529526; Thu, 30 Apr 2026 03:03:59 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=meta.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=s2048-2025-q2; bh=6y5xPQjarSGEV+y856igX3W4+XZQDOVNzN2cIpOJfv4=; b=YmBIXFu/IBR/ 7U9n6cx/6lzIOIF9Bq+sFDB+sjrjMre5w5UsIE7qQEESry1Zo/JPjrQMSrDp1och U+vVtBsL2TDi7IvsBW7Q/4fGOyioQeBDRFgtgCejh0ePq2/SCoa0if5eZOk6d7xo 3uZe9hdtuoEopKZrMUTwFtrak/dytZwSEvchkv1IALZQDM6afLJFQ0wuvHhZPl82 sahH2gV/k8ZaAwXm63hdGjezAaQ58bJ2JE22aQQSypW0B+SvBDhNWfAlXqv0Fw08 WqWeuIcFSo6ia099tq8NW4UL59LQwcNv0YShjpMU8t8ca3wpSDlMoJbUd0qDaqAj IpYU1Me6pg== Received: from maileast.thefacebook.com ([163.114.135.16]) by mx0a-00082601.pphosted.com (PPS) with ESMTPS id 4dty68g8dj-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT); Thu, 30 Apr 2026 03:03:58 -0700 (PDT) Received: from localhost (2620:10d:c0a8:fe::f072) by mail.thefacebook.com (2620:10d:c0a9:6f::237c) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.2.2562.37; Thu, 30 Apr 2026 10:03:57 +0000 From: Matt Evans To: Alex Williamson , Kevin Tian , Jason Gunthorpe , Ankit Agrawal , Alistair Popple , Leon Romanovsky , Kees Cook , Shameer Kolothum , Yishai Hadas CC: Alexey Kardashevskiy , Eric Auger , Peter Xu , Vivek Kasireddy , Zhi Wang , , , Subject: [PATCH v3 3/3] vfio/pci: Check BAR resources before exporting a DMABUF Date: Thu, 30 Apr 2026 03:03:22 -0700 Message-ID: <20260430100340.2787446-4-mattev@meta.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260430100340.2787446-1-mattev@meta.com> References: <20260430100340.2787446-1-mattev@meta.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-ORIG-GUID: 7W9HOYZL-GCC9RGL966pvYUOVVUmgvqi X-Proofpoint-GUID: 7W9HOYZL-GCC9RGL966pvYUOVVUmgvqi X-Authority-Analysis: v=2.4 cv=XbS5Co55 c=1 sm=1 tr=0 ts=69f3290e cx=c_pps a=MfjaFnPeirRr97d5FC5oHw==:117 a=MfjaFnPeirRr97d5FC5oHw==:17 a=A5OVakUREuEA:10 a=VkNPw1HP01LnGYTKEx00:22 a=7x6HtfJdh03M6CCDgxCd:22 a=_1IyUuN4QrATX339ibzo:22 a=VabnemYjAAAA:8 a=Cv6RvFvLZYHFA_XSKfkA:9 a=gKebqoRLp9LExxC7YDUY:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNDMwMDEwMCBTYWx0ZWRfXynVzco6fl7gu wiT2yo6NFZ9QmshXN4+CLCYKen/PaeJSZYMkyXikY0l2EtSKlS363sibRcBth/exSEILPw3pC2Q bkvOgn9x5EpqTPdBCsfNTdQyKkTE6v5JUuUgt9bnv5TJs++jeiiIYeLGehoeGeV+urSeYsF6JXO 51Uab29yej9alCiKeD20g9ufhovywPsIyGJVjvtVBvIOOPUrGxIifenjOTYsLCD4Oacsin/xJqo DWyE93ZbJEY75KxvjM4uee61WO5XCnDgU69VOehZYGyi7038Cf9DnYkl3M8hMI4L4RFCDZi3shF 1M69nhaHiQiDKrQWaDd3R7QtRtT6m9tEEkf6n5Lu0w88YylKKa3fUHrPKqY5RlwZMrIa/xGI9md AOpMZOC5V89GZ8xKptzn6vijFTb8V5q+yXozCa9VZKiA4wc4+A/rk928IPQBQpA4BR3RjPo309O ni1+ZHCZIvGbjrQeOVw== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-04-30_03,2026-04-28_01,2025-10-01_01 Content-Type: text/plain; charset="utf-8" A DMABUF exports access to BAR resources and, although they are requested at startup time, we need to ensure they really were reserved before exporting. Otherwise, it's possible to access unreserved resources through the export. Add a check to the DMABUF-creation path. Fixes: 5d74781ebc86c ("vfio/pci: Add dma-buf export support for MMIO region= s") Signed-off-by: Matt Evans --- drivers/vfio/pci/vfio_pci_dmabuf.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/vfio/pci/vfio_pci_dmabuf.c b/drivers/vfio/pci/vfio_pci= _dmabuf.c index f87fd32e4a01..3bc7d850e258 100644 --- a/drivers/vfio/pci/vfio_pci_dmabuf.c +++ b/drivers/vfio/pci/vfio_pci_dmabuf.c @@ -244,9 +244,11 @@ int vfio_pci_core_feature_dma_buf(struct vfio_pci_core= _device *vdev, u32 flags, return -EINVAL; =20 /* - * For PCI the region_index is the BAR number like everything else. + * For PCI the region_index is the BAR number like everything + * else. Check that PCI resources have been claimed for it. */ - if (get_dma_buf.region_index >=3D VFIO_PCI_ROM_REGION_INDEX) + if (get_dma_buf.region_index >=3D VFIO_PCI_ROM_REGION_INDEX || + !IS_ERR(vfio_pci_core_get_iomap(vdev, get_dma_buf.region_index))) return -ENODEV; =20 dma_ranges =3D memdup_array_user(&arg->dma_ranges, get_dma_buf.nr_ranges, --=20 2.47.3