Re: [RFC PATCH 0/4] vfio/pci: Allow hiding BAR ranges from the VFIO user

[Alex Williamson <alex@shazbot.org>]

On Thu, 5 Nov 2026 16:37:34 +0100
"Piórkowski, Piotr" <piotr.piorkowski@intel.com> wrote:

> From: Piotr Piórkowski <piotr.piorkowski@intel.com>
> 
> Some devices have BAR ranges which shouldn't be exposed to the VFIO
> user, but vfio-pci exposes the memory BARs as a whole, apart from the
> MSI-X table.
> 
> This series lets the host hide ranges of the memory BARs. Reads of a
> hidden range return ones, writes to it are dropped, the pages containing
> it are never mapped (a sparse mmap capability advertises the rest of the
> BAR), and ioeventfds and dma-bufs covering it are rejected. The ranges
> are fixed while the device is bound and listed in
> /sys/.../vfio-dev/vfioX/hidden_bar_ranges.
> 
> The ranges can be hidden by the driver, with
> vfio_pci_core_hide_bar_ranges(), and by the host administrator, through
> configfs (CONFIG_VFIO_PCI_CONFIGFS). Only drivers which access their
> BARs exclusively through vfio-pci-core can hide ranges; vfio-pci and
> xe-vfio-pci declare it.
> 
> Patch 1 is a preparatory refactor, patch 2 adds the core mechanism,
> patch 3 the configfs interface and patch 4 per-device-ID defaults in
> xe-vfio-pci, with no ranges defined yet.
> 
> Sent as RFC for feedback on the approach and the interfaces.

See Manish's proposal for a generic excluded range interface to
generalize MSI-X table read/write and disable all access to CXL HDM
decoders:

https://lore.kernel.org/all/20261016161839.2765592-9-mhonap@nvidia.com/

Granting users the ability to manipulate excluded ranges through
configfs seems like a terrible idea, frankly.  Thanks,

Alex

> 
> Piotr Piórkowski (4):
>   vfio/pci: Move the excluded range handling out of
>     vfio_pci_core_do_io_rw()
>   vfio/pci: Allow hiding BAR ranges from the VFIO user
>   vfio/pci: Allow configuring hidden BAR ranges through configfs
>   vfio/xe: Hide BAR ranges by default per device ID
> 
>  Documentation/ABI/testing/configfs-vfio-pci   |  49 +++
>  .../ABI/testing/sysfs-devices-vfio-dev        |  13 +
>  drivers/vfio/pci/Kconfig                      |  13 +
>  drivers/vfio/pci/Makefile                     |   4 +-
>  drivers/vfio/pci/nvgrace-gpu/main.c           |   4 +-
>  drivers/vfio/pci/vfio_pci.c                   |   1 +
>  drivers/vfio/pci/vfio_pci_configfs.c          | 312 +++++++++++++++++
>  drivers/vfio/pci/vfio_pci_core.c              |  42 ++-
>  drivers/vfio/pci/vfio_pci_dmabuf.c            |  11 +
>  drivers/vfio/pci/vfio_pci_hidden_bar_ranges.c | 313 ++++++++++++++++++
>  drivers/vfio/pci/vfio_pci_priv.h              |  53 +++
>  drivers/vfio/pci/vfio_pci_rdwr.c              | 156 +++++++--
>  drivers/vfio/pci/xe/main.c                    |  60 +++-
>  include/linux/vfio_pci_core.h                 |  36 +-
>  14 files changed, 1009 insertions(+), 58 deletions(-)
>  create mode 100644 Documentation/ABI/testing/configfs-vfio-pci
>  create mode 100644 drivers/vfio/pci/vfio_pci_configfs.c
>  create mode 100644 drivers/vfio/pci/vfio_pci_hidden_bar_ranges.c
>