From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f179.google.com (mail-qk1-f179.google.com [209.85.222.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6E83624DCF8 for ; Thu, 31 Jul 2025 16:53:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1753980785; cv=none; b=N0nJKFNu09LEYFICRNBHVCUT7Zmm2RcF8U6iLflr08SS0XcPwueEhAksbooASBiqhZDK+0qSwj1+MVdLX21+96hATbfMrO+VNE6n2pr32GaX4PK20KXbl4XSvEl/NWoqBTT/XEP1+JtGIhXc4H1+iyOtqX/2t1Z5NJS1duaU4a8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1753980785; c=relaxed/simple; bh=pZ8JW4BupERaCqn+7ehMHUhgMaXIyZtrBvv8TKORWvQ=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=i+twxJi6RN7dH16Wi820uOy3FCyp0SKd8oTRL0dW3efXY03dbcnKFJT5WSiFBHwGUZraZ6J/0hmZZ4/2v77+z/ET+po8dRLUa6T0Xagcldh7SZ9Aq9YEqbGbnEzucAY9H54QkgrEIB+C33wqvfrbhitCJ1WIEkMc/DtnRT7RXSk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca; spf=pass smtp.mailfrom=ziepe.ca; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b=Zs9UvslR; arc=none smtp.client-ip=209.85.222.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b="Zs9UvslR" Received: by mail-qk1-f179.google.com with SMTP id af79cd13be357-7dd8773f9d9so92696685a.2 for ; Thu, 31 Jul 2025 09:53:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ziepe.ca; s=google; t=1753980782; x=1754585582; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=ge8sFkdUD5dsmHZi6nhZDTs93Pw2wZ3dkBFapdPEw0U=; b=Zs9UvslRTgz6E55v8B7c2Jadpo09wvghL4NqoXx9WmGhULRAJntAGfFZiCo3SoyNge BbuWQbgthZ59HyrQMZJ5TXr7/zsovLi8hlsIeDy+ERKJrpOydsNIgfnCLBEqggKhGAWc V7F9yzToWc4KjSTgotmjRO+W/lGqOs55jSyk5OLkhJTsVH97PUAaXhTy3jH+iZHiH1Kn liYvCM2TDHmZToa04HFTyLrWTWPhkvhQC1j38+4lgcyL9+Xg1ISCG3nM5SNE8Z+0tHbL +5+Uq2/is0dmDULstCDnfW/Ce9oINBLnEfM2J2FdEbA35xe2rF3CX92GkA41lFHQpOPE If2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1753980782; x=1754585582; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=ge8sFkdUD5dsmHZi6nhZDTs93Pw2wZ3dkBFapdPEw0U=; b=abphip9mwMBTBFndLUUTZI1YyekJS/iUMj+lQQS2EGeoqQLKqac0pj2IclWzmSg3lM 3KL1t0mpFNmNZiBj3LoMM0/kWhN5JPKSeEwHjZD25FnrIT4aEbtCefa0nyKvvvSlhF/j r8Ch/nznvL1ctY1u+KsvyAocpGzklJWqcOliimn2CAvTC8GxG8/GuF3aNKmuQRdjTP5X VzlJpVGBbQBgWm3wslQGUt+cuVKx9jLhAa+MRXVlfUVoy1zKd/OoirdUWbSyVNopsHlu 6WXv44eSM5DY5cb6YODv0gVT8XmWbhjdfNvp2EX4+Oi4My8kenuaNc62tu+HWfYfeXjB 2S9Q== X-Forwarded-Encrypted: i=1; AJvYcCX124s9bNOnOH15JAfRz018NAFX0setBXeumQu0vM+/52Rtkk4bkUJFk9Ly7F8G58IzVLWNOdZAxxuo8dw=@vger.kernel.org X-Gm-Message-State: AOJu0YwIC061lw4J2i+bvGFdN7hiPpdalDvD0choZTUkxsyWnBvXQalU 9llBu8h5IQrWJtOJBsodFO+rSK6wya+VDhxNRlETDSGfo2OY9lXsPTh3C8wP9SxsbKY= X-Gm-Gg: ASbGnctTLxYGzwmLE5nMB971olNsZOtQKZDE9gy2esc/GfXviQyk25OtAKuYC+jaZX7 Y3O82/FpCATQBVl1ekl6XPHUTWSJfoHu4Ni4hMoaNkt9k0NWvIkqJ/MNJ05H9tcRYDEjidDO3aR UaLah3z6zeumhv0HOnftSROCMrjmIzZHBVv/OU+Y/r7TebvgzurEvEgS5z3KOgUbq1wqkhfXvHt 530Wom1caoxwixM0dL9ArWCG38hBBaONkoL5f5cSfMKTLFJP9yt/mNUse162dpq2k4l07QHWbKz rViMdpw8iuUHD7pjkcvxYIBML8jle5ZjPERME2cO+Cyzd4TbQW10iCyJNdMm0NIuRv9JNjFVKzx QU2GYp0NrgVo5flDSy641Mf3TwIdpUsHKJlx4LPR42tXSPPSlraqG/XAVj1KmOH6EVlyOqMjU21 y/mPY= X-Google-Smtp-Source: AGHT+IFxkpl6QnLP1d2Hal87IlMNzkW4ERQZ01Eb9frEOc1Kw3im7nXPwCw8k1/LtI/6s3msgQWswQ== X-Received: by 2002:a05:620a:2808:b0:7e3:4b7c:40a0 with SMTP id af79cd13be357-7e66f3e29c2mr1060489785a.51.1753980782245; Thu, 31 Jul 2025 09:53:02 -0700 (PDT) Received: from ziepe.ca (hlfxns017vw-47-55-120-4.dhcp-dynamic.fibreop.ns.bellaliant.net. [47.55.120.4]) by smtp.gmail.com with ESMTPSA id af79cd13be357-7e67f5c5537sm108625985a.35.2025.07.31.09.53.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 31 Jul 2025 09:53:01 -0700 (PDT) Received: from jgg by wakko with local (Exim 4.97) (envelope-from ) id 1uhWWb-00000000qDo-1Gf4; Thu, 31 Jul 2025 13:53:01 -0300 Date: Thu, 31 Jul 2025 13:53:01 -0300 From: Jason Gunthorpe To: Arto Merilainen Cc: "Aneesh Kumar K.V (Arm)" , linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, aik@amd.com, lukas@wunner.de, Samuel Ortiz , Xu Yilun , Suzuki K Poulose , Steven Price , Catalin Marinas , Marc Zyngier , Will Deacon , Oliver Upton , kvmarm@lists.linux.dev, linux-coco@lists.linux.dev Subject: Re: [RFC PATCH v1 34/38] coco: guest: arm64: Validate mmio range found in the interface report Message-ID: <20250731165301.GY26511@ziepe.ca> References: <20250728135216.48084-1-aneesh.kumar@kernel.org> <20250728135216.48084-35-aneesh.kumar@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Thu, Jul 31, 2025 at 02:39:09PM +0300, Arto Merilainen wrote: > On 28.7.2025 16.52, Aneesh Kumar K.V (Arm) wrote: > > > + for (int i = 0; i < interface_report->mmio_range_count; i++, mmio_range++) { > > + > > + /*FIXME!! units in 4K size*/ > > + range_id = FIELD_GET(TSM_INTF_REPORT_MMIO_RANGE_ID, mmio_range->range_attributes); > > + > > + /* no secure interrupts */ > > + if (msix_tbl_bar != -1 && range_id == msix_tbl_bar) { > > + pr_info("Skipping misx table\n"); > > + continue; > > + } > > + > > + if (msix_pba_bar != -1 && range_id == msix_pba_bar) { > > + pr_info("Skipping misx pba\n"); > > + continue; > > + } > > + > > > MSI-X and PBA can be placed to a BAR that has other registers as well. While > the PCIe specification recommends BAR-level isolation for MSI-X structures, > it is not mandated. Right, there are not enough BARs in most devices to give MSI its own BAR. > It is enough to have sufficient isolation within the > BAR. Therefore, skipping the MSI-X and PBA BARs altogether may leave > registers unintentionally mapped via unprotected IPA when they > should have been mapped via protected IPA. Right, this sounds bad. > Instead of skipping the whole BAR, would it make sense to determine > where the MSI-X related regions reside, and skip validation only from these > regions? IMHO this is a mess. The virtualization must end up putting a shared page(s) covering the MSI space in the middle of the MMIO region. I think this should be done by fragmenting the layout in the IPA where the private MMIO is within the protected IPA space with an unmapped hole covering the MSIX registers. The acceptance process should validate this. The MSIX registers would then be located in the shared IPA space. A normal driver mmaping it's BAR will then crash if it tries to access the MSIX registers. This is good, we want to catch these non-secure configurations and block them. The MSI code will have to know to compute the shared IPA alias and use that. Jason