mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Longfang Liu <liulongfang@huawei.com>
To: <alex.williamson@redhat.com>, <jgg@nvidia.com>
Cc: <kvm@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
	<liulongfang@huawei.com>
Subject: [PATCH 2/2] hisi_acc_vfio_pci: fix VF BAR2 mmap on 64KB page size
Date: Mon, 3 Aug 2026 10:18:57 +0800	[thread overview]
Message-ID: <20260803021857.2370179-3-liulongfang@huawei.com> (raw)
In-Reply-To: <20260803021857.2370179-1-liulongfang@huawei.com>

    On HW_ACC_MIG_VF_CTRL hardware, VF BAR2 is split into functional
and migration register regions. When kernel page size exceeds the
functional region size (e.g. 64KB pages vs 32KB functional region),
guest mmap operations get rounded up to page size, causing the VMA
to exceed functional boundaries and fail validation.
    The solution aligns mmap boundaries to page size while maintaining
byte-granularity access control through hisi_acc_pci_rw_access_check()
for read/write operations and accurate region size reporting via
hisi_acc_vfio_ioctl_get_region(), ensuring migration registers remain
protected from non-mmap access while resolving compatibility issues.

Signed-off-by: Longfang Liu <liulongfang@huawei.com>
---
 drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
index 36490be7a61a..44b3e7d8fef5 100644
--- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
+++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
@@ -1355,14 +1355,21 @@ static int hisi_acc_vfio_pci_mmap(struct vfio_device *core_vdev,
 	index = vma->vm_pgoff >> (VFIO_PCI_OFFSET_SHIFT - PAGE_SHIFT);
 	if (index == VFIO_PCI_BAR2_REGION_INDEX) {
 		u64 req_len, pgoff, req_start;
-		resource_size_t end;
+		resource_size_t end, dev_len;
 
-		end = hisi_acc_get_resource_len(vdev, index);
+		dev_len = hisi_acc_get_resource_len(vdev, index);
 		req_len = vma->vm_end - vma->vm_start;
 		pgoff = vma->vm_pgoff &
 			((1U << (VFIO_PCI_OFFSET_SHIFT - PAGE_SHIFT)) - 1);
 		req_start = pgoff << PAGE_SHIFT;
-
+		/*
+		 * The BAR2 functional region (dev_len) may be smaller than the
+		 * kernel page size. Align it to PAGE_SIZE so a page-rounded
+		 * guest mmap is not rejected, which would make the VF unusable.
+		 * The read/write path still truncates at the real functional
+		 * boundary, keeping the migration registers inaccessible.
+		 */
+		end = PAGE_ALIGN(dev_len);
 		if (req_start + req_len > end)
 			return -EINVAL;
 	}
-- 
2.43.0


  parent reply	other threads:[~2026-08-03  2:20 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-03  2:18 [PATCH 0/2] fix two issues related to the driver Longfang Liu
2026-08-03  2:18 ` [PATCH 1/2] hisi_acc_vfio_pci: fix live migration enable conditions for PF passthrough Longfang Liu
2026-08-04 19:28   ` Alex Williamson
2026-08-05  2:19     ` liulongfang
2026-08-05  3:15       ` Alex Williamson
2026-08-19  7:50         ` liulongfang
2026-08-03  2:18 ` Longfang Liu [this message]
2026-08-04 19:27   ` [PATCH 2/2] hisi_acc_vfio_pci: fix VF BAR2 mmap on 64KB page size Alex Williamson
2026-08-05  2:54     ` liulongfang

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260803021857.2370179-3-liulongfang@huawei.com \
    --to=liulongfang@huawei.com \
    --cc=alex.williamson@redhat.com \
    --cc=jgg@nvidia.com \
    --cc=kvm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®