1 files changed, 49 insertions, 2 deletions

diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index 909499b73d03..021f722e2481 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -733,6 +733,25 @@ static ssize_t intel_vgpu_rw(struct mdev_device *mdev, char *buf,
         return ret == 0 ? count : ret;
 }
 
+static bool gtt_entry(struct mdev_device *mdev, loff_t *ppos)
+{
+        struct intel_vgpu *vgpu = mdev_get_drvdata(mdev);
+        unsigned int index = VFIO_PCI_OFFSET_TO_INDEX(*ppos);
+        struct intel_gvt *gvt = vgpu->gvt;
+        int offset;
+
+        /* Only allow MMIO GGTT entry access */
+        if (index != PCI_BASE_ADDRESS_0)
+                return false;
+
+        offset = (u64)(*ppos & VFIO_PCI_OFFSET_MASK) -
+                intel_vgpu_get_bar_gpa(vgpu, PCI_BASE_ADDRESS_0);
+
+        return (offset >= gvt->device_info.gtt_start_offset &&
+                offset < gvt->device_info.gtt_start_offset + gvt_ggtt_sz(gvt)) ?
+                        true : false;
+}
+
 static ssize_t intel_vgpu_read(struct mdev_device *mdev, char __user *buf,
                         size_t count, loff_t *ppos)
 {
@@ -742,7 +761,21 @@ static ssize_t intel_vgpu_read(struct mdev_device *mdev, char __user *buf,
         while (count) {
                 size_t filled;
 
-                if (count >= 4 && !(*ppos % 4)) {
+                /* Only support GGTT entry 8 bytes read */
+                if (count >= 8 && !(*ppos % 8) &&
+                        gtt_entry(mdev, ppos)) {
+                        u64 val;
+
+                        ret = intel_vgpu_rw(mdev, (char *)&val, sizeof(val),
+                                        ppos, false);
+                        if (ret <= 0)
+                                goto read_err;
+
+                        if (copy_to_user(buf, &val, sizeof(val)))
+                                goto read_err;
+
+                        filled = 8;
+                } else if (count >= 4 && !(*ppos % 4)) {
                         u32 val;
 
                         ret = intel_vgpu_rw(mdev, (char *)&val, sizeof(val),
@@ -802,7 +835,21 @@ static ssize_t intel_vgpu_write(struct mdev_device *mdev,
         while (count) {
                 size_t filled;
 
-                if (count >= 4 && !(*ppos % 4)) {
+                /* Only support GGTT entry 8 bytes write */
+                if (count >= 8 && !(*ppos % 8) &&
+                        gtt_entry(mdev, ppos)) {
+                        u64 val;
+
+                        if (copy_from_user(&val, buf, sizeof(val)))
+                                goto write_err;
+
+                        ret = intel_vgpu_rw(mdev, (char *)&val, sizeof(val),
+                                        ppos, true);
+                        if (ret <= 0)
+                                goto write_err;
+
+                        filled = 8;
+                } else if (count >= 4 && !(*ppos % 4)) {
                         u32 val;
 
                         if (copy_from_user(&val, buf, sizeof(val)))