Re: [PATCH 2/2] hisi_acc_vfio_pci: fix VF BAR2 mmap on 64KB page size

[Alex Williamson <alex@shazbot.org>]

On Mon, 3 Aug 2026 10:18:57 +0800
Longfang Liu <liulongfang@huawei.com> wrote:

>     On HW_ACC_MIG_VF_CTRL hardware, VF BAR2 is split into functional
> and migration register regions. When kernel page size exceeds the
> functional region size (e.g. 64KB pages vs 32KB functional region),
> guest mmap operations get rounded up to page size, causing the VMA
> to exceed functional boundaries and fail validation.
>     The solution aligns mmap boundaries to page size while maintaining
> byte-granularity access control through hisi_acc_pci_rw_access_check()
> for read/write operations and accurate region size reporting via
> hisi_acc_vfio_ioctl_get_region(), ensuring migration registers remain
> protected from non-mmap access while resolving compatibility issues.
> 
> Signed-off-by: Longfang Liu <liulongfang@huawei.com>
> ---
>  drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 13 ++++++++++---
>  1 file changed, 10 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
> index 36490be7a61a..44b3e7d8fef5 100644
> --- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
> +++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
> @@ -1355,14 +1355,21 @@ static int hisi_acc_vfio_pci_mmap(struct vfio_device *core_vdev,
>  	index = vma->vm_pgoff >> (VFIO_PCI_OFFSET_SHIFT - PAGE_SHIFT);
>  	if (index == VFIO_PCI_BAR2_REGION_INDEX) {
>  		u64 req_len, pgoff, req_start;
> -		resource_size_t end;
> +		resource_size_t end, dev_len;
>  
> -		end = hisi_acc_get_resource_len(vdev, index);
> +		dev_len = hisi_acc_get_resource_len(vdev, index);
>  		req_len = vma->vm_end - vma->vm_start;
>  		pgoff = vma->vm_pgoff &
>  			((1U << (VFIO_PCI_OFFSET_SHIFT - PAGE_SHIFT)) - 1);
>  		req_start = pgoff << PAGE_SHIFT;
> -
> +		/*
> +		 * The BAR2 functional region (dev_len) may be smaller than the
> +		 * kernel page size. Align it to PAGE_SIZE so a page-rounded
> +		 * guest mmap is not rejected, which would make the VF unusable.
> +		 * The read/write path still truncates at the real functional
> +		 * boundary, keeping the migration registers inaccessible.
> +		 */
> +		end = PAGE_ALIGN(dev_len);
>  		if (req_start + req_len > end)
>  			return -EINVAL;
>  	}

You may still be restricting read/write access into the migration
range of the BAR, but doesn't this give the user full access to that
extended range through the mmap?  It seems they only need to access
beyond the advertised region length through the mmap to bypass
hisi_acc_pci_rw_access_check().

If they can do that, what are we even still protecting?

Alex