Re: [PATCH 2/2] hisi_acc_vfio_pci: fix VF BAR2 mmap on 64KB page size

On 2026/8/5 3:27, Alex Williamson wrote:
> On Mon, 3 Aug 2026 10:18:57 +0800
> Longfang Liu <[email protected]> wrote:
> 
>>     On HW_ACC_MIG_VF_CTRL hardware, VF BAR2 is split into functional
>> and migration register regions. When kernel page size exceeds the
>> functional region size (e.g. 64KB pages vs 32KB functional region),
>> guest mmap operations get rounded up to page size, causing the VMA
>> to exceed functional boundaries and fail validation.
>>     The solution aligns mmap boundaries to page size while maintaining
>> byte-granularity access control through hisi_acc_pci_rw_access_check()
>> for read/write operations and accurate region size reporting via
>> hisi_acc_vfio_ioctl_get_region(), ensuring migration registers remain
>> protected from non-mmap access while resolving compatibility issues.
>>
>> Signed-off-by: Longfang Liu <[email protected]>
>> ---
>>  drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 13 ++++++++++---
>>  1 file changed, 10 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
>> index 36490be7a61a..44b3e7d8fef5 100644
>> --- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
>> +++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
>> @@ -1355,14 +1355,21 @@ static int hisi_acc_vfio_pci_mmap(struct vfio_device *core_vdev,
>>  	index = vma->vm_pgoff >> (VFIO_PCI_OFFSET_SHIFT - PAGE_SHIFT);
>>  	if (index == VFIO_PCI_BAR2_REGION_INDEX) {
>>  		u64 req_len, pgoff, req_start;
>> -		resource_size_t end;
>> +		resource_size_t end, dev_len;
>>  
>> -		end = hisi_acc_get_resource_len(vdev, index);
>> +		dev_len = hisi_acc_get_resource_len(vdev, index);
>>  		req_len = vma->vm_end - vma->vm_start;
>>  		pgoff = vma->vm_pgoff &
>>  			((1U << (VFIO_PCI_OFFSET_SHIFT - PAGE_SHIFT)) - 1);
>>  		req_start = pgoff << PAGE_SHIFT;
>> -
>> +		/*
>> +		 * The BAR2 functional region (dev_len) may be smaller than the
>> +		 * kernel page size. Align it to PAGE_SIZE so a page-rounded
>> +		 * guest mmap is not rejected, which would make the VF unusable.
>> +		 * The read/write path still truncates at the real functional
>> +		 * boundary, keeping the migration registers inaccessible.
>> +		 */
>> +		end = PAGE_ALIGN(dev_len);
>>  		if (req_start + req_len > end)
>>  			return -EINVAL;
>>  	}
> 
> You may still be restricting read/write access into the migration
> range of the BAR, but doesn't this give the user full access to that
> extended range through the mmap?  It seems they only need to access
> beyond the advertised region length through the mmap to bypass
> hisi_acc_pci_rw_access_check().
> 
> If they can do that, what are we even still protecting?
> 
> Alex
> .
>

Yes, the issue you mentioned is indeed a serious problem. We need to prevent this
type of security vulnerability where memory segments intended only for kernel access
are exposed to VM users.

Thanks.
Longfang.