This will replace irq_domain_check_msi_remap() in following patches.
The new API makes it more clear what "msi_remap" actually means from a
functional perspective instead of identifying an implementation specific
HW feature.
Secure MSI means that an irq_domain on the path from the initiating device
to the CPU will validate that the MSI message specifies an interrupt
number that the initiating device is authorized to trigger. Secure MSI
must block devices from triggering interrupts they are not authorized to
trigger. Currently authorization means the MSI vector is one assigned to
the device.
This determination is interesting for VMs where assigning a device to VM A
should not allow VM A to trigger interrupts on VM B or the host via rouge
MSI operations, eg by mimicking MSI using PCI MemWr DMA.
As this is actually modeled as a per-irq_domain property, not a global
platform property, correct the interface to accept the device parameter
and scan through only the part of the irq_domains hierarchy originating
from the source device.
Locate the new code in msi.c as it naturally only works with
CONFIG_GENERIC_MSI_IRQ, which also requires CONFIG_IRQ_DOMAIN and
IRQ_DOMAIN_HIERARCHY.
Cc: Eric Auger <eric.auger@xxxxxxxxxx>
Cc: Marc Zyngier <marc.zyngier@xxxxxxx>
Cc: Tomasz Nowicki <tomasz.nowicki@xxxxxxxxxxxxxxxxxx>
Cc: Bharat Bhushan <bharat.bhushan@xxxxxxx>
Cc: Will Deacon <will.deacon@xxxxxxx>
Signed-off-by: Jason Gunthorpe <jgg@xxxxxxxxxx>
---
include/linux/msi.h | 13 +++++++++++++
kernel/irq/msi.c | 25 +++++++++++++++++++++++++
2 files changed, 38 insertions(+)
diff --git a/include/linux/msi.h b/include/linux/msi.h
index a112b913fff949..75c2c4e71fc34c 100644
--- a/include/linux/msi.h
+++ b/include/linux/msi.h
@@ -649,6 +649,19 @@ int platform_msi_device_domain_alloc(struct irq_domain *domain, unsigned int vir
void platform_msi_device_domain_free(struct irq_domain *domain, unsigned int virq,
unsigned int nvec);
void *platform_msi_get_host_data(struct irq_domain *domain);
+
+bool msi_device_has_secure_msi(struct device *dev);
+#else /* CONFIG_GENERIC_MSI_IRQ */
+static inline bool msi_device_has_secure_msi(struct device *dev)
+{
+ /*
+ * Arguably if the platform does not enable MSI support then it has
+ * "secure MSI", as an interrupt controller that cannot receive MSIs is
+ * inherently secure by our definition. As nobody seems to needs this be
+ * conservative and return false anyhow.
+ */
+ return false;
+}
#endif /* CONFIG_GENERIC_MSI_IRQ */
/* PCI specific interfaces */
diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c
index bd4d4dd626b4bd..7a7d9f969001c7 100644
--- a/kernel/irq/msi.c
+++ b/kernel/irq/msi.c
@@ -1622,3 +1622,28 @@ struct msi_domain_info *msi_get_domain_info(struct irq_domain *domain)
{
return (struct msi_domain_info *)domain->host_data;
}
+
+/**
+ * msi_device_has_secure_msi - True if the device has secure MSI
+ * @dev: The device to check
+ *
+ * Secure MSI means that an irq_domain on the path from the initiating device to
+ * the CPU will validate that the MSI message specifies an interrupt number that
+ * the device is authorized to trigger. This must block devices from triggering
+ * interrupts they are not authorized to trigger. Currently authorization means
+ * the MSI vector is one assigned to the device.
+ *
+ * This is interesting for VMs where assigning device to a VM A should not allow
+ * VM A to trigger interrupts on VM B via rouge MSI operations, eg by mimicking
+ * MSI using PCI MemWr DMA.
+ */
+bool msi_device_has_secure_msi(struct device *dev)
+{
+ struct irq_domain *domain = dev_get_msi_domain(dev);
+
+ for (; domain; domain = domain->parent)
+ if (domain->flags & IRQ_DOMAIN_FLAG_MSI_REMAP)
+ return true;
+ return false;
+}
+EXPORT_SYMBOL_GPL(msi_device_has_secure_msi);
--
2.38.1
