From: Steven Noonan <steven@edera.dev>

With vPCI, you shouldn't need to use xen-pciback for the device, so the
memory access permissions need to be defined somewhere. This allows vPCI
to automatically define the access permissions so that the domU can map
the BARs via IOMMU.

Signed-off-by: Steven Noonan <steven@edera.dev>
Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 xen/drivers/vpci/header.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/xen/drivers/vpci/header.c b/xen/drivers/vpci/header.c
index 1f930b2a1f..ad3c09667f 100644
--- a/xen/drivers/vpci/header.c
+++ b/xen/drivers/vpci/header.c
@@ -1017,6 +1017,18 @@ int vpci_init_header(struct pci_dev *pdev)
         bars[i].size = size;
         bars[i].prefetchable = val & PCI_BASE_ADDRESS_MEM_PREFETCH;
 
+        if ( !is_hwdom )
+        {
+            int rc = iomem_permit_access(pdev->domain,
+                                        PFN_DOWN(addr),
+                                        PFN_DOWN(addr + size - 1));
+            if ( rc )
+            {
+                printk(XENLOG_WARNING "Failed to grant MMIO access for BAR%d: %d\n", i, rc);
+                goto fail;
+            }
+        }
+
         rc = vpci_add_register(pdev->vpci,
                                is_hwdom ? vpci_hw_read32 : guest_mem_bar_read,
                                is_hwdom ? bar_write : guest_mem_bar_write,
@@ -1040,6 +1052,18 @@ int vpci_init_header(struct pci_dev *pdev)
         header->rom_enabled = pci_conf_read32(pdev->sbdf, rom_reg) &
                               PCI_ROM_ADDRESS_ENABLE;
 
+        if ( !is_hwdom )
+        {
+            int rc = iomem_permit_access(pdev->domain,
+                                        PFN_DOWN(addr),
+                                        PFN_DOWN(addr + size - 1));
+            if ( rc )
+            {
+                printk(XENLOG_WARNING "Failed to grant MMIO access for ROM BAR: %d\n", rc);
+                goto fail;
+            }
+        }
+
         rc = vpci_add_register(pdev->vpci, vpci_hw_read32, rom_write, rom_reg,
                                4, rom);
         if ( rc )
-- 
2.53.0

On 25.02.2026 00:12, Ariadne Conill wrote:
> From: Steven Noonan <steven@edera.dev>
> 
> With vPCI, you shouldn't need to use xen-pciback for the device, so the
> memory access permissions need to be defined somewhere. This allows vPCI
> to automatically define the access permissions so that the domU can map
> the BARs via IOMMU.

What if XSM had something to say about this? IOW no, I don't think this is
permissible. xen-pciback needed or not, that's not where permissions are
granted. It's still the toolstack which needs to do that.

Also you're never undoing the granting of the extra permissions.

Jan