From: Manish Honap vfio-cxl owns the whole component BAR and serves the HDM decoder block through a trapped region that runs the commit FSM against a shadow. Left directly mmappable, the same block would let userspace reach the physical decoder and move the host physical window. Exclude it from the BAR mmap so the trap is the only path to it. Signed-off-by: Manish Honap --- drivers/vfio/pci/cxl/vfio_cxl_core.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/vfio/pci/cxl/vfio_cxl_core.c b/drivers/vfio/pci/cxl/vfio_cxl_core.c index 07047646edde..f91f6eb8b8fb 100644 --- a/drivers/vfio/pci/cxl/vfio_cxl_core.c +++ b/drivers/vfio/pci/cxl/vfio_cxl_core.c @@ -339,6 +339,14 @@ static int vfio_cxl_init_device(struct vfio_pci_core_device *vdev) cxl->hdm_len = pdev->hdm->hdm_size; + /* + * The HDM decoder block is served from the trapped component-register + * region. Keep it out of the guest's direct BAR mapping so the physical + * decoder, which governs host memory decode, cannot be reprogrammed. + */ + vfio_pci_core_set_mmap_exclude(vdev, pdev->hdm->hdm_bar, + pdev->hdm->hdm_offset, cxl->hdm_len); + ret = cxl_set_capacity(&cxl->cxlds, hdm_size); if (ret) return ret; -- 2.25.1