Re: [PATCH 3/4] vfio/pci: Add PCIe TPH GET_ST interface

[Wathsala Vithanage <wathsala.vithanage@arm.com>]

Hi Feng,

get_st  feature is unsafe. It allows a rogue userspace driver in 
device-specific
mode to obtain steering tags for arbitrary CPUs, including ones unrelated
to the device or its workload, enabling it to direct traffic into those 
CPUs’
caches and potentially interfere with other workloads, opening doors to
further exploits depending on other vulnerabilities.

That's why we dropped this capability in 
https://lore.kernel.org/kvm/20251013163515.16565-1-wathsala.vithanage@arm.com/

--wathsala

>   }
>   
> +static int vfio_pci_tph_get_st(struct vfio_pci_core_device *vdev,
> +			       struct vfio_device_pci_tph_op *op,
> +			       void __user *uarg)
> +{
> +	struct vfio_pci_tph_entry *ents;
> +	struct vfio_pci_tph_st st;
> +	enum tph_mem_type mtype;
> +	size_t size;
> +	int i, err;
> +
> +	if (copy_from_user(&st, uarg, sizeof(st)))
> +		return -EFAULT;
> +
> +	if (!st.count || st.count > 2048)
> +		return -EINVAL;
> +
> +	size = st.count * sizeof(*ents);
> +	ents = kvmalloc(size, GFP_KERNEL);
> +	if (!ents)
> +		return -ENOMEM;
> +
> +	if (copy_from_user(ents, uarg + sizeof(st), size)) {
> +		err = -EFAULT;
> +		goto out;
> +	}
> +
> +	for (i = 0; i < st.count; i++) {
> +		if (ents[i].mem_type == VFIO_PCI_TPH_MEM_TYPE_VM) {
> +			mtype = TPH_MEM_TYPE_VM;
> +		} else if (ents[i].mem_type == VFIO_PCI_TPH_MEM_TYPE_PM) {
> +			mtype = TPH_MEM_TYPE_PM;
> +		} else {
> +			err = -EINVAL;
> +			goto out;
> +		}
> +
> +		err = pcie_tph_get_cpu_st(vdev->pdev, mtype, ents[i].cpu, &ents[i].st);
> +		if (err)
> +			goto out;
> +	}
> +
> +	if (copy_to_user(uarg + sizeof(st), ents, size))
> +		err = -EFAULT;
> +
> +out:
> +	kvfree(ents);
> +	return err;
> +}
> +
>   static int vfio_pci_ioctl_tph(struct vfio_pci_core_device *vdev,
>   			      void __user *uarg)
>   {
> @@ -1544,6 +1593,8 @@ static int vfio_pci_ioctl_tph(struct vfio_pci_core_device *vdev,
>   		return vfio_pci_tph_enable(vdev, &op, uarg + minsz);
>   	case VFIO_PCI_TPH_DISABLE:
>   		return vfio_pci_tph_disable(vdev);
> +	case VFIO_PCI_TPH_GET_ST:
> +		return vfio_pci_tph_get_st(vdev, &op, uarg + minsz);
>   	default:
>   		/* Other ops are not implemented yet */
>   		return -EINVAL;