mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity

genirq/msi: Add msi_device_has_isolated_msi() 

This will replace irq_domain_check_msi_remap() in following patches.

The new API makes it more clear what "msi_remap" actually means from a
functional perspective instead of identifying an implementation specific
HW feature.

Isolated MSI means that HW modeled by an irq_domain on the path from the
initiating device to the CPU will validate that the MSI message specifies
an interrupt number that the device is authorized to trigger. This must
block devices from triggering interrupts they are not authorized to
trigger.  Currently authorization means the MSI vector is one assigned to
the device.

This is interesting for securing VFIO use cases where a rouge MSI (eg
created by abusing a normal PCI MemWr DMA) must not allow the VFIO
userspace to impact outside its security domain, eg userspace triggering
interrupts on kernel drivers, a VM triggering interrupts on the
hypervisor, or a VM triggering interrupts on another VM.

As this is actually modeled as a per-irq_domain property, not a global
platform property, correct the interface to accept the device parameter
and scan through only the part of the irq_domains hierarchy originating
from the source device.

Locate the new code in msi.c as it naturally only works with
CONFIG_GENERIC_MSI_IRQ, which also requires CONFIG_IRQ_DOMAIN and
IRQ_DOMAIN_HIERARCHY.

Link: https://lore.kernel.org/r/1-v3-3313bb5dd3a3+10f11-secure_msi_jgg@nvidia.com
Tested-by: Matthew Rosato <mjrosato@linux.ibm.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
This commit is contained in:
Jason Gunthorpe 2022-11-28 17:06:42 -04:00
parent b7bfaa761d
commit 17cde5e601
2 changed files with 40 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
include/linux/msi.h
View File

@ -649,6 +649,19 @@ int platform_msi_device_domain_alloc(struct irq_domain *domain, unsigned int vir
void platform_msi_device_domain_free(struct irq_domain *domain, unsigned int virq,
unsigned int nvec);
void *platform_msi_get_host_data(struct irq_domain *domain);
bool msi_device_has_isolated_msi(struct device *dev);
#else /* CONFIG_GENERIC_MSI_IRQ */
static inline bool msi_device_has_isolated_msi(struct device *dev)
{
/*
* Arguably if the platform does not enable MSI support then it has
* "isolated MSI", as an interrupt controller that cannot receive MSIs
* is inherently isolated by our definition. As nobody seems to needs
* this be conservative and return false anyhow.
*/
return false;
}
#endif /* CONFIG_GENERIC_MSI_IRQ */
/* PCI specific interfaces */

27
kernel/irq/msi.c
View File

@ -1623,3 +1623,30 @@ struct msi_domain_info *msi_get_domain_info(struct irq_domain *domain)
{
return (struct msi_domain_info *)domain->host_data;
}
/**
* msi_device_has_isolated_msi - True if the device has isolated MSI
* @dev: The device to check
*
* Isolated MSI means that HW modeled by an irq_domain on the path from the
* initiating device to the CPU will validate that the MSI message specifies an
* interrupt number that the device is authorized to trigger. This must block
* devices from triggering interrupts they are not authorized to trigger.
* Currently authorization means the MSI vector is one assigned to the device.
*
* This is interesting for securing VFIO use cases where a rouge MSI (eg created
* by abusing a normal PCI MemWr DMA) must not allow the VFIO userspace to
* impact outside its security domain, eg userspace triggering interrupts on
* kernel drivers, a VM triggering interrupts on the hypervisor, or a VM
* triggering interrupts on another VM.
*/
bool msi_device_has_isolated_msi(struct device *dev)
{
struct irq_domain *domain = dev_get_msi_domain(dev);
for (; domain; domain = domain->parent)
if (domain->flags & IRQ_DOMAIN_FLAG_MSI_REMAP)
return true;
return false;
}
EXPORT_SYMBOL_GPL(msi_device_has_isolated_msi);