Re: [RFC PATCH v1 34/38] coco: guest: arm64: Validate mmio range found in the interface report

Jason Gunthorpe
2025-09-11T13:41:11Z

On Thu, Sep 11, 2025 at 11:03:50AM +0530, Aneesh Kumar K.V wrote:

> But we need to validate the interface report before accepting the device,
> and the device driver is only loaded after the device has been accepted.

+1

This must work from the generic OS code.

So I'd say add a new TSM op:
int validate_pci_bar_range(struct pci_dev *pdev,
unsigned int bar_index, u64 tdisp_pa,
u64 size,phys_addr_t *bar_offset_out);

TSM has broadly two options to compute bar_offset_out:

1) Require the TDISP MMIO Offset is aligned to the BAR size and use
something like:

*bar_offset_out = (tdisp_pa) % pci_resource_len(pdev, bar_index);
ipa = pci_resource_start(pdev, bar_index) + *bar_offset_out;
if (size + *bar_offset_out > pci_resource_len(pdev, bar_index))
return -EINVAL;
tsm_call_to_validate(pdev, ipa, pa, size)

2) Require the TSM to convert the offest'd PA to the IPA:

tsm_call_to_convert(pdev, pa, size, &ipa);

if (ipa < pci_resource_start(pdev, bar_index) ||
ipa >= pci_resource_end(pdev, bar_index) ||
(ipa + size) > pci_resource_end(pdev, bar_index))
return -EINVAL;

*bar_offset_out = ipa - pci_resource_start(pdev, bar_index);

Then the generic code builds a map of what parts of the BAR are secure
and what are not.

If it can't do either the TSM is unusable by Linux.

Jason