From: Abdifatah Suruur <suruurism@gmail.com>
To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: alex@shazbot.org, eric.auger@redhat.com, smostafa@google.com,
praan@google.com, ioana.ciornei@nxp.com, nipun.gupta@amd.com,
nikhil.agarwal@amd.com
Subject: [PATCH 4/7] vfio/platform: keep logical vm_pgoff in MMIO region mmap
Date: Mon, 21 Sep 2026 15:23:31 +0300 [thread overview]
Message-ID: <20260921122334.2099-5-suruurism@gmail.com> (raw)
In-Reply-To: <20260921122334.2099-1-suruurism@gmail.com>
vfio_platform_mmap_mmio() overwrites vma->vm_pgoff with the physical
frame number of the MMIO region and passes it to remap_pfn_range().
The VMA is inserted into the device file's mapping->i_mmap interval
tree keyed by vm_pgoff, which VFIO expects to be the logical file
offset: the core links every device mmap to the device inode's
i_mapping precisely so that unmap_mapping_range() can revoke all
mappings associated with a device (see vfio_device_cdev_open()).
With a raw PFN in vm_pgoff the interval tree entry lands in the wrong
coordinate space and unmap_mapping_range() cannot find the VMA,
leaving stale MMIO mappings behind any revocation attempt. Keep
vm_pgoff in the logical VFIO offset space, as vfio-pci does, and pass
the physical PFN to remap_pfn_range() explicitly.
This is defensive hygiene: none of vfio-platform, vfio/fsl-mc and
vfio/cdx call unmap_mapping_range() today, so no reachable
stale-mapping issue exists. Keeping vm_pgoff logical preserves the
VFIO core contract for any future revocation path.
Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>
---
--- a/drivers/vfio/platform/vfio_platform_common.c
+++ b/drivers/vfio/platform/vfio_platform_common.c
@@ -561,6 +561,5 @@
vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
- vma->vm_pgoff = (region.addr >> PAGE_SHIFT) + pgoff;
-
- return remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
+ return remap_pfn_range(vma, vma->vm_start,
+ (region.addr >> PAGE_SHIFT) + pgoff,
req_len, vma->vm_page_prot);
}
next prev parent reply other threads:[~2026-09-21 12:23 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-21 12:23 [PATCH 0/7] vfio: mmap()/mprotect() hygiene for MMIO region mappings Abdifatah Suruur
2026-09-21 12:23 ` [PATCH 1/7] vfio/platform: prevent read-only region mappings from becoming writable Abdifatah Suruur
2026-09-21 12:23 ` [PATCH 2/7] vfio/fsl-mc: " Abdifatah Suruur
2026-09-21 12:23 ` [PATCH 3/7] vfio/cdx: " Abdifatah Suruur
2026-09-21 12:23 ` Abdifatah Suruur [this message]
2026-09-21 12:23 ` [PATCH 5/7] vfio/fsl-mc: keep logical vm_pgoff in MMIO region mmap Abdifatah Suruur
2026-09-21 12:23 ` [PATCH 6/7] vfio/cdx: " Abdifatah Suruur
2026-09-21 12:23 ` [PATCH 7/7] vfio/cdx: reject non-shared MMIO mmaps Abdifatah Suruur
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260921122334.2099-5-suruurism@gmail.com \
--to=suruurism@gmail.com \
--cc=alex@shazbot.org \
--cc=eric.auger@redhat.com \
--cc=ioana.ciornei@nxp.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nikhil.agarwal@amd.com \
--cc=nipun.gupta@amd.com \
--cc=praan@google.com \
--cc=smostafa@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®