From nobody Mon Sep 28 08:46:35 2026 Received: from canpmsgout04.his.huawei.com (canpmsgout04.his.huawei.com [113.46.200.219]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CEE5D3AE712; Mon, 24 Aug 2026 08:29:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.219 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787560174; cv=none; b=otIH4OaRy0tDjxQeMQ9HcZZEwZunkM2mdhZ7mmwUcFvmgW+y17AcKvtu04xeIw01UibN8b71aHMLjWtZ75by8BcSAuTftOMOInwB36g+KnGRHY56VXOkqAbJO7/Q6FMrERRIZgsaWvRG8v+PtzZlMlY0FGKhGgzxdxLO1gl09Qo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787560174; c=relaxed/simple; bh=IARrRNNyiTAKoF6wwICzbs9Wa28MtqXKIxPUJZ1ERvk=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=E6HaWlLVVHIMc2Jb2mmxJm3HE2k7kOTrl/qCmjQ0d8vSVuOBTOunazPQZzl+1qFUZj61i6lJMoV2bZGqaouNYLd4UMDSg4VqoZbcatw7/ESRFy5TxX6iMOmuvizoWj7ZpglcPqfZcn45uzejJKf3TFHz3Zeg4AgydtexXnLCn0o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=fID65l5t; arc=none smtp.client-ip=113.46.200.219 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="fID65l5t" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=LYTsOMWil8VNbH9yTrDfh9/73Sw9jTDzZkwHDpz4ui4=; b=fID65l5tZ8Qh3HVzMbR/8vat7qoT2rQwOF4Dd2QvL9C47nAqf+QMzb2kDhJeSzlmCKYYUQsJ7 yVGXKNQktB+6fwBN7Aqp5RtvLJePXDbqPVRgkKOWoW+J4SKzBqzQYb0YkGvh/m/Qp9REymJj34O XxiIEQwjBTueeuXXv8pvfRE= Received: from mail.maildlp.com (unknown [172.19.162.197]) by canpmsgout04.his.huawei.com (SkyGuard) with ESMTPS id 4hT3hY3Hr1z1prKd; Mon, 24 Aug 2026 16:18:37 +0800 (CST) Received: from dggpemf500015.china.huawei.com (unknown [7.185.36.143]) by mail.maildlp.com (Postfix) with ESMTPS id C0BA240579; Mon, 24 Aug 2026 16:29:23 +0800 (CST) Received: from huawei.com (10.50.163.32) by dggpemf500015.china.huawei.com (7.185.36.143) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Mon, 24 Aug 2026 16:29:23 +0800 From: Longfang Liu To: , CC: , , Subject: [PATCH v2 1/2] hisi_acc_vfio_pci: fix live migration enable conditions for PF passthrough Date: Mon, 24 Aug 2026 16:28:50 +0800 Message-ID: <20260824082851.1436129-2-liulongfang@huawei.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260824082851.1436129-1-liulongfang@huawei.com> References: <20260824082851.1436129-1-liulongfang@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems100002.china.huawei.com (7.221.188.206) To dggpemf500015.china.huawei.com (7.185.36.143) Content-Type: text/plain; charset="utf-8" When a PF device is bound to the live migration driver in passthrough mode, it cannot support live migration functionality, and key pointers will remain uninitialized. Although most migration functions within the driver are unreachable, low-level error handling callbacks may be triggered directly, causing a crash due to null pointer dereference. The fix involves adding validity checks at three entry points: device probe, error handling, and migration initialization. If the pointer is invalid, the operation is exited or rejected directly to avoid crashes, while redundant internal checks are removed. Fixes: b0eed085903e ("hisi_acc_vfio_pci: Add support for VFIO live migratio= n") Signed-off-by: Longfang Liu --- .../vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 24 ++++++++++++++----- 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/= pci/hisilicon/hisi_acc_vfio_pci.c index 86362ec424a5..e95d0ab0f11a 100644 --- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c +++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c @@ -1154,9 +1154,14 @@ static void hisi_acc_vf_pci_reset_prepare(struct pci= _dev *pdev) { struct hisi_acc_vf_core_device *hisi_acc_vdev =3D hisi_acc_drvdata(pdev); struct hisi_qm *qm =3D hisi_acc_vdev->pf_qm; - struct device *dev =3D &qm->pdev->dev; + struct device *dev =3D &pdev->dev; u32 delay =3D 0; =20 + if (!qm || !qm->io_base) { + dev_err(dev, "PF QM not available for reset\n"); + return; + } + /* All reset requests need to be queued for processing */ while (test_and_set_bit(QM_RESETTING, &qm->misc_ctl)) { msleep(1); @@ -1174,8 +1179,12 @@ static void hisi_acc_vf_pci_aer_reset_done(struct pc= i_dev *pdev) struct hisi_acc_vf_core_device *hisi_acc_vdev =3D hisi_acc_drvdata(pdev); struct hisi_qm *qm =3D hisi_acc_vdev->pf_qm; =20 - if (hisi_acc_vdev->set_reset_flag) - clear_bit(QM_RESETTING, &qm->misc_ctl); + if (hisi_acc_vdev->set_reset_flag) { + if (qm && qm->io_base) + clear_bit(QM_RESETTING, &qm->misc_ctl); + else + dev_err(&pdev->dev, "PF QM not available for reset done\n"); + } =20 if (!hisi_acc_vdev->core_device.vdev.mig_ops) return; @@ -1565,6 +1574,11 @@ static int hisi_acc_vfio_pci_migrn_init_dev(struct v= fio_device *core_vdev) struct pci_dev *pdev =3D to_pci_dev(core_vdev->dev); struct hisi_qm *pf_qm =3D hisi_acc_get_pf_qm(pdev); =20 + if (!pf_qm) { + dev_err(&pdev->dev, "PF driver not loaded, cannot enable migration\n"); + return -ENODEV; + } + hisi_acc_vdev->vf_id =3D pci_iov_vf_id(pdev) + 1; hisi_acc_vdev->pf_qm =3D pf_qm; hisi_acc_vdev->vf_dev =3D pdev; @@ -1670,13 +1684,11 @@ static int hisi_acc_vfio_pci_probe(struct pci_dev *= pdev, const struct pci_device struct hisi_acc_vf_core_device *hisi_acc_vdev; const struct vfio_device_ops *ops =3D &hisi_acc_vfio_pci_ops; struct hisi_qm *pf_qm; - int vf_id; int ret; =20 pf_qm =3D hisi_acc_get_pf_qm(pdev); if (pf_qm && pf_qm->ver >=3D QM_HW_V3) { - vf_id =3D pci_iov_vf_id(pdev); - if (vf_id >=3D 0) + if (pdev->is_virtfn) ops =3D &hisi_acc_vfio_pci_migrn_ops; else pci_warn(pdev, "migration support failed, continue with generic interfa= ce\n"); --=20 2.43.0 From nobody Mon Sep 28 08:46:35 2026 Received: from canpmsgout10.his.huawei.com (canpmsgout10.his.huawei.com [113.46.200.225]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C67113A1690; Mon, 24 Aug 2026 08:29:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.225 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787560205; cv=none; b=r7mO/K2BOo203Uw+uc85gGqpNjsW9IrH7Cvarqo+/mdl7CXxjrOHeMcAVVo51GQoa2SHWTz6qPvXDv0JfKlnQ8tLUrcP6tlX0Hzr+fNH6PprzcL6iMl6gaEAR6qw0FOcLAC2Qz3H28a9/JCAoCL32oNLmoZiD2y/feJpPB/W4TI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787560205; c=relaxed/simple; bh=V+zVqgBW+5YHXH+lVtisbOOKy4bNL5t/TJOq9NXERYc=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=maEJZ178UuVEC5TiWGK0VJTTkBBf+6Tq43qp0L9S5tc7uPHGDkFomlvGn5dPoSD1wmzjZeE8KyN4U3ouL3SbIqwjXpL+XbXp0HMuEqt83MdEgg/ju9Q/f+mp5MgY021anO+VmFnjKMlZc76aLG0Im+10ToLo6mYwj5mHIKwvHc4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=WrcQPYdu; arc=none smtp.client-ip=113.46.200.225 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="WrcQPYdu" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=WnyD1w0MzGk6U19nu+YUYowWjy0UsFHj2ZyWdRSEcXI=; b=WrcQPYduyidanR9tKkUJpjk/n4+L9oe+vqBCYKNsH1xx9pyRHgq4Sx+bwzTUA/EnUAnhzz+dL gyCZ8RDDsJlSo31Z0SARMNxpuRRG/wcSjjLcgkzLfx2JYYTGHHnbVz5tdtem2b6QAcCDlNodMaj jdE11QSxhNhNDDKKEQ9Zw6A= Received: from mail.maildlp.com (unknown [172.19.163.15]) by canpmsgout10.his.huawei.com (SkyGuard) with ESMTPS id 4hT3jB2Ywlz1K9CV; Mon, 24 Aug 2026 16:19:10 +0800 (CST) Received: from dggpemf500015.china.huawei.com (unknown [7.185.36.143]) by mail.maildlp.com (Postfix) with ESMTPS id DB4D240578; Mon, 24 Aug 2026 16:29:54 +0800 (CST) Received: from huawei.com (10.50.163.32) by dggpemf500015.china.huawei.com (7.185.36.143) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Mon, 24 Aug 2026 16:29:54 +0800 From: Longfang Liu To: , CC: , , Subject: [PATCH v2 2/2] hisi_acc_vfio_pci: reject live migration on 64KB page with QM_HW_V3 hardware Date: Mon, 24 Aug 2026 16:28:51 +0800 Message-ID: <20260824082851.1436129-3-liulongfang@huawei.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260824082851.1436129-1-liulongfang@huawei.com> References: <20260824082851.1436129-1-liulongfang@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems100002.china.huawei.com (7.221.188.206) To dggpemf500015.china.huawei.com (7.185.36.143) Content-Type: text/plain; charset="utf-8" In the scenario combining QM_HW_V3 hardware with 64KB large pages, the device functional region and migration registers share the BAR2 physical page, resulting in a lack of isolation that triggers security issues. More critically, since KVM does not support the specific 16-byte read/write instructions used by the guest driver, operating under the KVM emulated device scheme will lead to Guest kernel calltrace issues. To prevent Guest exceptions and avoid security vulnerabilities, the driver directly disables live migration functionality in this scenario. This ensures the system fails cleanly with an error early during startup, while other configuration modes remain unaffected and can still utilize passthrough functionality normally. Fixes: b0eed085903e ("hisi_acc_vfio_pci: Add support for VFIO live migratio= n") Signed-off-by: Longfang Liu --- drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/= pci/hisilicon/hisi_acc_vfio_pci.c index e95d0ab0f11a..4e845474fa90 100644 --- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c +++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c @@ -1208,6 +1208,23 @@ static int hisi_acc_vf_qm_init(struct hisi_acc_vf_co= re_device *hisi_acc_vdev) else hisi_acc_vdev->drv_mode =3D HW_ACC_MIG_VF_CTRL; =20 + /* + * On VF_CTRL hardware, BAR2 holds 32KB functional + 32KB + * migration registers. When the host page exceeds 32KB, the + * two share one physical page and cannot be isolated by mmap. + * Reject the open so QEMU fails cleanly at startup. + */ + if (hisi_acc_vdev->drv_mode =3D=3D HW_ACC_MIG_VF_CTRL) { + resource_size_t func_len =3D + pci_resource_len(vf_dev, VFIO_PCI_BAR2_REGION_INDEX) >> 1; + + if (func_len < PAGE_SIZE) { + dev_err(&vf_dev->dev, + "migration not supported on 64KB pages with QM_HW_V3\n"); + return -EINVAL; + } + } + if (hisi_acc_vdev->drv_mode =3D=3D HW_ACC_MIG_PF_CTRL) { /* * On hardware platforms greater than QM_HW_V3, the migration function --=20 2.43.0