[ This would be for v6.3, the series depends on a bunch of stuff in linux-next. I would be happy to merge it through the iommfd tree ] Currently the kernel has two ways to signal the "secure MSI" concept that IOMMU_CAP_INTR_REMAP and irq_domain_check_msi_remap() both lay claim to. Harmonize these into a single irq_domain based check under msi_device_has_secure_msi(). In real HW "secure MSI" is implemented in a few different ways: - x86 uses "interrupt remapping" which is a block that sits between the device and APIC, that can "remap" the MSI MemWr using per-RID tables. Part of the remapping is discarding, the per-RID tables will not contain vectors that have not been enabled for the device. - ARM GICv3 ITS integrates the concept of an out-of-band "device ID" directly into the interrupt controller logic. The tables the GIC checks that determine how to deliver the interrupt through the ITS device table and interrupt translation tables allow limiting which interrupts device IDs can trigger. - S390 has unconditionally claimed it has secure MSI through the iommu driver. I'm not sure how it works, or if it even does. Perhaps zpci_set_airq() pushes the "zdev->gias" to the hypervisor which limits a device's MSI to only certain KVM contexts (though if true this would be considered insecure by VFIO) After this series the "secure MSI" is tagged based only on the irq_domains that the interrupt travels through. For x86 enabling interrupt remapping causes IR irq_domains to be installed in the path, and they can carry the IRQ_DOMAIN_FLAG_SECURE_MSI. For ARM the GICv3 ITS itself already sets the flag when it is running in a secure mode, and S390 simply sets it always through an arch hook since it doesn't use irq_domains at all. This removes the intrusion of entirely IRQ subsystem information into the iommu layer. Linux's iommu_domains abstraction has no bearing at all on the security of MSI. Even if HW linked to the IOMMU may implement the security on x86 implementations, Linux models that HW through the irq_domain, not the iommu_domain. This is on github: https://github.com/jgunthorpe/linux/commits/secure_msi Signed-off-by: Jason Gunthorpe <jgg@xxxxxxxxxx> Jason Gunthorpe (9): irq: Add msi_device_has_secure_msi() vfio/type1: Check that every device supports IOMMU_CAP_INTR_REMAP vfio/type1: Convert to msi_device_has_secure_msi() iommufd: Convert to msi_device_has_secure_msi() irq: Remove unused irq_domain_check_msi_remap() code irq: Rename MSI_REMAP to SECURE_MSI iommu/x86: Replace IOMMU_CAP_INTR_REMAP with IRQ_DOMAIN_FLAG_SECURE_MSI irq/s390: Add arch_is_secure_msi() for s390 iommu: Remove IOMMU_CAP_INTR_REMAP arch/s390/include/asm/msi.h | 12 +++++++++ drivers/iommu/amd/iommu.c | 5 ++-- drivers/iommu/intel/iommu.c | 2 -- drivers/iommu/intel/irq_remapping.c | 3 ++- drivers/iommu/iommufd/device.c | 5 ++-- drivers/iommu/s390-iommu.c | 2 -- drivers/irqchip/irq-gic-v3-its.c | 4 +-- drivers/vfio/vfio_iommu_type1.c | 16 ++++++------ include/linux/iommu.h | 1 - include/linux/irqdomain.h | 27 ++------------------ include/linux/msi.h | 17 +++++++++++++ kernel/irq/irqdomain.c | 39 ----------------------------- kernel/irq/msi.c | 25 ++++++++++++++++++ 13 files changed, 73 insertions(+), 85 deletions(-) create mode 100644 arch/s390/include/asm/msi.h base-commit: 644f4ef9a6ea0e0c65f949bd6b80857d4223c476 -- 2.38.1
