From nobody Tue Sep 29 14:54:11 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D197524BBEB; Thu, 6 Aug 2026 22:54:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786056864; cv=none; b=gc/3mxx05CQLyfjQYCdkLPA3LOVKMc13EthNg2SuKpD8SsTpmBMfLdwgrj9RwPU7nhVbV6p5Gt+D8cGaC61i0zvTbUMCYwhdWiXpJ1cxO9UvGLD2goJ7GcB/doFQaYd9QnPSwxPe9zSytv34kpyXIGs4A6TIzDHlXlecDM2MHl4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786056864; c=relaxed/simple; bh=EswZbLIymDV78mlHCKO1X9RoDxtu8++4Db/0dUSTLg4=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=LrOoGD+z+LsNZjcCxTZKr3PEVg95bu/IDBj8lswOH89f8f6aM1tKNN4HI5Q0ko11r9sQBMahQs6oKPhpPy+2h7xJESadbqWhZLGL44UDn8KWAEwFWt2fcZGgcdQo1l9MCUmpD1ixYnqKogsoxnNLw5Ec1pfjcU74WLBmkFvESFc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=kLwLxnj6; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="kLwLxnj6" Received: by smtp.kernel.org (Postfix) with ESMTPS id 4B43FC2BCB9; Thu, 6 Aug 2026 22:54:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1786056864; bh=EswZbLIymDV78mlHCKO1X9RoDxtu8++4Db/0dUSTLg4=; h=From:Date:Subject:To:Cc:Reply-To:From; b=kLwLxnj6KstuqzXETBibV6jB28GfEYDFU1o/WcdPcdys6aQIjWr6ZdGGR7wVEqnm6 sHwTZS6xSa+lUMv3nNOhvofYYx47ZyEfybDW4fZ0lQ8Cm62qG+maFBI0MUkirZmbJB udNqDJErKPaeo7RFVKNqmvW1EKEL0lOJmP7uIbOJWM5KcUhNk6QrDOP+4JJuZYg04s CYiOGeAuiJt16jn+GNArdolXqf3FC9G6iOvrF40MJSp3+x24joFeus6kn6WVaW0uTy Cbhtd4Wx8I6swWJGBRlnumMvon49+nUWoiyxR97BV0AU/2vfGk/q53+xcLVjNG2v/C nvlg6MDTB3sSw== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 35AD9C5AC67; Thu, 6 Aug 2026 22:54:24 +0000 (UTC) From: Benjamin Leggett via B4 Relay Date: Thu, 06 Aug 2026 18:54:22 -0400 Subject: [PATCH] drm/virtio: use the DMA API for resource backing on Xen Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260806-virtgpu-xen-dma-v1-1-e499b345bbad@edera.io> X-B4-Tracking: v=1; b=H4sIAAAAAAAC/6tWKk4tykwtVrJSqFYqSi3LLM7MzwNyDHUUlJIzE vPSU3UzU4B8JSMDIzMDCwMz3bLMopL0glLditQ83ZTcRF1TU8u0xCRzQyMjUwMloK6CotS0zAq widGxtbUAa8lnjGEAAAA= X-Change-ID: 20260806-virtgpu-xen-dma-559fab712250 To: David Airlie , Gerd Hoffmann , Dmitry Osipenko , Gurchetan Singh , Chia-I Wu , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , Simona Vetter Cc: dri-devel@lists.freedesktop.org, virtualization@lists.linux.dev, linux-kernel@vger.kernel.org, Ben Leggett X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1786056863; l=5117; i=benjamin@edera.io; s=20260806; h=from:subject:message-id; bh=wOAOsTbxcJcarhT0acP0MXmZRyShNWCmuRTeZhTGsRo=; b=4+NAupK4c499Zt43GWkSTU3w6pT4fPZUWSAhfAyYMGcFp06hUfiwYUNZnTcyc9O+EaHbyldKx ZyC5JedYANLBElw059I+qxXEW+gPbCXP3xKdJ+zYukfWynE+t5Nf7q9 X-Developer-Key: i=benjamin@edera.io; a=ed25519; pk=prj3m3DtYeYw1akLHnM/sXm8eau0Ar/IO93YoYnOr+I= X-Endpoint-Received: by B4 Relay for benjamin@edera.io/20260806 with auth_id=923 X-Original-From: Benjamin Leggett Reply-To: benjamin@edera.io From: Benjamin Leggett On a Xen PV domain page addresses bear no relation to the real machine addresses the host would have to use to reach it. virtio_ring.c handles this correctly, vring_use_map_api() returns true for any xen_domain() regardless of VIRTIO_F_ACCESS_PLATFORM. virtio-gpu makes the same decision independently, but its copy looks only at the feature bit: bool use_dma_api =3D !virtio_has_dma_quirk(vgdev->vdev); QEMU does not set iommu_platform on virtio-vga by default, so VIRTIO_F_ACCESS_PLATFORM is not negotiated, use_dma_api is false, and virtio_gpu_object_shmem_init() describes the framebuffer's backing pages to the host with sg_phys(). Those are guest-physical addresses. In a PV domain they resolve, on the host side, to pages belonging to some other domain, so the host scans out unrelated memory. Move the decision into virtio_gpu_use_dma_api() and give it the xen_domain() check, like vring_use_map_api() has. This additionally enables the dma_sync_sgtable_for_device() calls in virtgpu_vq.c, which are required for correctness whenever swiotlb is in play. Reproduced with a Xen 4.21 PV dom0 nested inside QEMU 8.2 with virtio-vga, on both a distro 6.8 kernel and 6.18 LTS. A PVH dom0 works fine and doesn't need this fix because it is identity-mapped, only PV dom0s are affected. Fixes: a3b815f09bb8 ("drm/virtio: add iommu support.") Signed-off-by: Ben Leggett Acked-by: Dmitry Osipenko --- drivers/gpu/drm/virtio/virtgpu_drv.h | 20 ++++++++++++++++++++ drivers/gpu/drm/virtio/virtgpu_object.c | 2 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 6 +++--- 3 files changed, 24 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h b/drivers/gpu/drm/virtio/= virtgpu_drv.h index 17a6a4d26516..09da7973387e 100644 --- a/drivers/gpu/drm/virtio/virtgpu_drv.h +++ b/drivers/gpu/drm/virtio/virtgpu_drv.h @@ -43,6 +43,8 @@ #include #include =20 +#include + #define DRIVER_NAME "virtio_gpu" #define DRIVER_DESC "virtio GPU" =20 @@ -60,6 +62,24 @@ /* See virtio_gpu_ctx_create. One additional character for NULL terminator= . */ #define DEBUG_NAME_MAX_LEN 65 =20 +/* + * Whether the host must be told about resource backing pages by DMA addre= ss + * rather than guest-physical address. + * + * This mirrors vring_use_map_api() in drivers/virtio/virtio_ring.c, inclu= ding + * its xen_domain() case. + */ +static inline bool virtio_gpu_use_dma_api(const struct virtio_device *vdev) +{ + if (!virtio_has_dma_quirk(vdev)) + return true; + + if (xen_domain()) + return true; + + return false; +} + struct virtio_gpu_object_params { unsigned long size; bool dumb; diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virt= io/virtgpu_object.c index 9bc0bd68c314..49899485be6f 100644 --- a/drivers/gpu/drm/virtio/virtgpu_object.c +++ b/drivers/gpu/drm/virtio/virtgpu_object.c @@ -173,7 +173,7 @@ static int virtio_gpu_object_shmem_init(struct virtio_g= pu_device *vgdev, struct virtio_gpu_mem_entry **ents, unsigned int *nents) { - bool use_dma_api =3D !virtio_has_dma_quirk(vgdev->vdev); + bool use_dma_api =3D virtio_gpu_use_dma_api(vgdev->vdev); struct scatterlist *sg; struct sg_table *pages; int si; diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/v= irtgpu_vq.c index 905b1f42cd98..568fefd713e0 100644 --- a/drivers/gpu/drm/virtio/virtgpu_vq.c +++ b/drivers/gpu/drm/virtio/virtgpu_vq.c @@ -764,7 +764,7 @@ int virtio_gpu_panic_cmd_transfer_to_host_2d(struct vir= tio_gpu_device *vgdev, struct virtio_gpu_object *bo =3D gem_to_virtio_gpu_obj(objs->objs[0]); struct virtio_gpu_transfer_to_host_2d *cmd_p; struct virtio_gpu_vbuffer *vbuf; - bool use_dma_api =3D !virtio_has_dma_quirk(vgdev->vdev); + bool use_dma_api =3D virtio_gpu_use_dma_api(vgdev->vdev); =20 if (virtio_gpu_is_shmem(bo) && use_dma_api) dma_sync_sgtable_for_device(vgdev->vdev->dev.parent, @@ -795,7 +795,7 @@ void virtio_gpu_cmd_transfer_to_host_2d(struct virtio_g= pu_device *vgdev, struct virtio_gpu_object *bo =3D gem_to_virtio_gpu_obj(objs->objs[0]); struct virtio_gpu_transfer_to_host_2d *cmd_p; struct virtio_gpu_vbuffer *vbuf; - bool use_dma_api =3D !virtio_has_dma_quirk(vgdev->vdev); + bool use_dma_api =3D virtio_gpu_use_dma_api(vgdev->vdev); =20 if (virtio_gpu_is_shmem(bo) && use_dma_api) dma_sync_sgtable_for_device(vgdev->vdev->dev.parent, @@ -1231,7 +1231,7 @@ void virtio_gpu_cmd_transfer_to_host_3d(struct virtio= _gpu_device *vgdev, struct virtio_gpu_object *bo =3D gem_to_virtio_gpu_obj(objs->objs[0]); struct virtio_gpu_transfer_host_3d *cmd_p; struct virtio_gpu_vbuffer *vbuf; - bool use_dma_api =3D !virtio_has_dma_quirk(vgdev->vdev); + bool use_dma_api =3D virtio_gpu_use_dma_api(vgdev->vdev); =20 if (virtio_gpu_is_shmem(bo) && use_dma_api) dma_sync_sgtable_for_device(vgdev->vdev->dev.parent, --- base-commit: bd4f284df04d76fd65e57141cb1e6e7a49e4c3cb change-id: 20260806-virtgpu-xen-dma-559fab712250 Best regards, --=20 Benjamin Leggett