All of lore.kernel.org
 help / color / mirror / Atom feed
From: Abdifatah Suruur <suruurism@gmail.com>
To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: alex@shazbot.org, eric.auger@redhat.com, smostafa@google.com,
	praan@google.com, ioana.ciornei@nxp.com, nipun.gupta@amd.com,
	nikhil.agarwal@amd.com
Subject: [PATCH v2 4/7] vfio/platform: keep logical vm_pgoff in MMIO region mmap
Date: Tue, 29 Sep 2026 12:48:45 +0300	[thread overview]
Message-ID: <20260929094848.7439-5-suruurism@gmail.com> (raw)
In-Reply-To: <20260929094848.7439-1-suruurism@gmail.com>

vfio_platform_mmap_mmio() overwrites vma->vm_pgoff with the physical
frame number of the MMIO region and passes it to remap_pfn_range().
The VMA is inserted into the device file's mapping->i_mmap interval
tree keyed by vm_pgoff, which VFIO expects to be the logical file
offset: the core links every device mmap to the device inode's
i_mapping precisely so that unmap_mapping_range() can revoke all
mappings associated with a device (see vfio_device_cdev_open()).

With a raw PFN in vm_pgoff the interval tree entry lands in the wrong
coordinate space and unmap_mapping_range() cannot find the VMA,
leaving stale MMIO mappings behind any revocation attempt.  Keep
vm_pgoff in the logical VFIO offset space, as vfio-pci does, and pass
the physical PFN to remap_pfn_range() explicitly.

This is defensive hygiene: none of vfio-platform, vfio/fsl-mc and
vfio/cdx call unmap_mapping_range() today, so no reachable
stale-mapping issue exists.  Keeping vm_pgoff logical preserves the
VFIO core contract for any future revocation path.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>
---
 drivers/vfio/platform/vfio_platform_common.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/platform/vfio_platform_common.c
index ab531318f170a..e8cfa76ad7f87 100644
--- a/drivers/vfio/platform/vfio_platform_common.c
+++ b/drivers/vfio/platform/vfio_platform_common.c
@@ -559,9 +559,8 @@ static int vfio_platform_mmap_mmio(struct vfio_platform_region region,
 		return -EINVAL;
 
 	vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
-	vma->vm_pgoff = (region.addr >> PAGE_SHIFT) + pgoff;
-
-	return remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
+	return remap_pfn_range(vma, vma->vm_start,
+			       (region.addr >> PAGE_SHIFT) + pgoff,
 			       req_len, vma->vm_page_prot);
 }
 
-- 
2.53.0


  parent reply	other threads:[~2026-09-29  9:49 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-29  9:48 [PATCH v2 0/7] vfio: mmap()/mprotect() hygiene for MMIO region mappings Abdifatah Suruur
2026-09-29  9:48 ` [PATCH v2 1/7] vfio/platform: prevent read-only region mappings from becoming writable Abdifatah Suruur
2026-09-29  9:48 ` [PATCH v2 2/7] vfio/fsl-mc: " Abdifatah Suruur
2026-09-29  9:48 ` [PATCH v2 3/7] vfio/cdx: " Abdifatah Suruur
2026-09-29  9:48 ` Abdifatah Suruur [this message]
2026-09-29  9:48 ` [PATCH v2 5/7] vfio/fsl-mc: keep logical vm_pgoff in MMIO region mmap Abdifatah Suruur
2026-09-29  9:48 ` [PATCH v2 6/7] vfio/cdx: " Abdifatah Suruur
2026-09-29  9:48 ` [PATCH v2 7/7] vfio/cdx: reject non-shared MMIO mmaps Abdifatah Suruur
2026-09-29 20:36   ` Alex Williamson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260929094848.7439-5-suruurism@gmail.com \
    --to=suruurism@gmail.com \
    --cc=alex@shazbot.org \
    --cc=eric.auger@redhat.com \
    --cc=ioana.ciornei@nxp.com \
    --cc=kvm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=nikhil.agarwal@amd.com \
    --cc=nipun.gupta@amd.com \
    --cc=praan@google.com \
    --cc=smostafa@google.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.