Parse the TDISP device interface report and drive the RSI
RDEV_VALIDATE_MAPPING handshake for each Realm MMIO window. The new
helper walks the reported ranges, rejects malformed entries, and either
validates the IPA->PA mapping when the device transitions to RUN or tears
it down with RIPAS updates on unlock.
Signed-off-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>
---
arch/arm64/include/asm/rsi_cmds.h | 29 ++++++++
arch/arm64/include/asm/rsi_smc.h | 4 +
drivers/virt/coco/arm-cca-guest/arm-cca.c | 9 +++
drivers/virt/coco/arm-cca-guest/rsi-da.c | 91 +++++++++++++++++++++++
drivers/virt/coco/arm-cca-guest/rsi-da.h | 24 +++++-
5 files changed, 156 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/include/asm/rsi_cmds.h b/arch/arm64/include/asm/rsi_cmds.h
index 18aa1b9efb9b..fe36dd2b96ac 100644
--- a/arch/arm64/include/asm/rsi_cmds.h
+++ b/arch/arm64/include/asm/rsi_cmds.h
@@ -185,4 +185,33 @@ static inline unsigned long rsi_host_call(phys_addr_t addr)
return res.a0;
}
+static inline long
+rsi_vdev_validate_mapping(unsigned long vdev_id,
+ phys_addr_t ipa_base, phys_addr_t ipa_top,
+ phys_addr_t pa_base, phys_addr_t *next_ipa,
+ unsigned long flags, unsigned long lock_nonce,
+ unsigned long meas_nonce, unsigned report_nonce)
+{
+ struct arm_smccc_1_2_regs res;
+ struct arm_smccc_1_2_regs regs = {
+ .a0 = SMC_RSI_VDEV_VALIDATE_MAPPING,
+ .a1 = vdev_id,
+ .a2 = ipa_base,
+ .a3 = ipa_top,
+ .a4 = pa_base,
+ .a5 = flags,
+ .a6 = lock_nonce,
+ .a7 = meas_nonce,
+ .a8 = report_nonce,
+ };
+
+ arm_smccc_1_2_invoke(®s, &res);
+ *next_ipa = res.a1;
+
+ if (res.a2 != RSI_ACCEPT)
+ return -EPERM;
+
+ return res.a0;
+}
+
#endif /* __ASM_RSI_CMDS_H */
diff --git a/arch/arm64/include/asm/rsi_smc.h b/arch/arm64/include/asm/rsi_smc.h
index 4dbd87a27d9b..26aaa97469e8 100644
--- a/arch/arm64/include/asm/rsi_smc.h
+++ b/arch/arm64/include/asm/rsi_smc.h
@@ -183,6 +183,10 @@ struct realm_config {
*/
#define SMC_RSI_IPA_STATE_GET SMC_RSI_FID(0x198)
+#define RSI_DEV_MEM_COHERENT BIT(0)
+#define RSI_DEV_MEM_LIMITED_ORDER BIT(1)
+#define SMC_RSI_VDEV_VALIDATE_MAPPING SMC_RSI_FID(0x19F)
+
struct rsi_host_call {
union {
u16 imm;
diff --git a/drivers/virt/coco/arm-cca-guest/arm-cca.c b/drivers/virt/coco/arm-cca-guest/arm-cca.c
index 7988ff6d4b2e..e86c3ad355f8 100644
--- a/drivers/virt/coco/arm-cca-guest/arm-cca.c
+++ b/drivers/virt/coco/arm-cca-guest/arm-cca.c
@@ -223,10 +223,19 @@ static struct pci_tsm *cca_tsm_lock(struct tsm_dev *tsm_dev, struct pci_dev *pde
static void cca_tsm_unlock(struct pci_tsm *tsm)
{
+ long ret;
struct cca_guest_dsc *cca_dsc = to_cca_guest_dsc(tsm->pdev);
+ /* invalidate dev mapping based on interface report */
+ ret = cca_apply_interface_report_mappings(tsm->pdev, false);
+ if (ret) {
+ pci_err(tsm->pdev, "failed to invalidate the interface report\n");
+ goto err_out;
+ }
+
cca_device_unlock(tsm->pdev);
+err_out:
kfree(cca_dsc);
}
diff --git a/drivers/virt/coco/arm-cca-guest/rsi-da.c b/drivers/virt/coco/arm-cca-guest/rsi-da.c
index aa6e13e4c0ea..c70fb7dd4838 100644
--- a/drivers/virt/coco/arm-cca-guest/rsi-da.c
+++ b/drivers/virt/coco/arm-cca-guest/rsi-da.c
@@ -105,3 +105,94 @@ int cca_update_device_object_cache(struct pci_dev *pdev, struct cca_guest_dsc *d
}
return 0;
}
+
+static inline int
+rsi_validate_dev_mapping(unsigned long vdev_id, phys_addr_t start_ipa,
+ phys_addr_t end_ipa, phys_addr_t io_pa,
+ unsigned long flags, unsigned long lock_nonce,
+ unsigned long meas_nonce, unsigned long report_nonce)
+{
+ unsigned long ret;
+ phys_addr_t next_ipa;
+
+ while (start_ipa < end_ipa) {
+ ret = rsi_vdev_validate_mapping(vdev_id, start_ipa, end_ipa,
+ io_pa, &next_ipa, flags,
+ lock_nonce, meas_nonce, report_nonce);
+ if (ret || next_ipa <= start_ipa || next_ipa > end_ipa)
+ return -EINVAL;
+ io_pa += next_ipa - start_ipa;
+ start_ipa = next_ipa;
+ }
+ return 0;
+}
+
+static inline int rsi_invalidate_dev_mapping(phys_addr_t start_ipa, phys_addr_t end_ipa)
+{
+ return rsi_set_memory_range(start_ipa, end_ipa, RSI_RIPAS_EMPTY,
+ RSI_CHANGE_DESTROYED);
+}
+
+int cca_apply_interface_report_mappings(struct pci_dev *pdev, bool validate)
+{
+ int ret;
+ struct resource *r;
+ unsigned int range_id;
+ phys_addr_t mmio_start_phys;
+ struct pci_tdisp_mmio_range *mmio_range;
+ phys_addr_t ipa_start, ipa_end, bar_offset;
+ struct pci_tdisp_device_interface_report *interface_report;
+ struct cca_guest_dsc *dsc = to_cca_guest_dsc(pdev);
+
+ interface_report = (struct pci_tdisp_device_interface_report *)dsc->interface_report;
+ mmio_range = (struct pci_tdisp_mmio_range *)(interface_report + 1);
+
+
+ for (int i = 0; i < interface_report->mmio_range_count; i++, mmio_range++) {
+
+ range_id = FIELD_GET(TSM_INTF_REPORT_MMIO_RANGE_ID, mmio_range->range_attributes);
+
+ if (range_id >= PCI_NUM_RESOURCES) {
+ pci_warn(pdev, "Skipping broken range [%d] #%d %d\n",
+ i, range_id, mmio_range->num_pages);
+ continue;
+ }
+
+ r = pci_resource_n(pdev, range_id);
+
+ if (r->end == r->start ||
+ resource_size(r) & ~PAGE_MASK || !mmio_range->num_pages) {
+ pci_warn(pdev, "Skipping broken range [%d] #%d %d pages, %llx..%llx\n",
+ i, range_id, mmio_range->num_pages, r->start, r->end);
+ continue;
+ }
+
+ if (FIELD_GET(TSM_INTF_REPORT_MMIO_IS_NON_TEE, mmio_range->range_attributes)) {
+ pci_info(pdev, "Skipping non-TEE range [%d] #%d %d pages, %llx..%llx\n",
+ i, range_id, mmio_range->num_pages, r->start, r->end);
+ continue;
+ }
+
+ /* No secure interrupts, we should not find this set, ignore for now. */
+ if (FIELD_GET(TSM_INTF_REPORT_MMIO_MSIX_TABLE, mmio_range->range_attributes) ||
+ FIELD_GET(TSM_INTF_REPORT_MMIO_PBA, mmio_range->range_attributes)) {
+ pci_info(pdev, "Skipping MSIX (%ld/%ld) range [%d] #%d %d pages, %llx..%llx\n",
+ FIELD_GET(TSM_INTF_REPORT_MMIO_MSIX_TABLE, mmio_range->range_attributes),
+ FIELD_GET(TSM_INTF_REPORT_MMIO_PBA, mmio_range->range_attributes),
+ i, range_id, mmio_range->num_pages, r->start, r->end);
+ continue;
+ }
+
+ /* units in 4K size*/
+ mmio_start_phys = mmio_range->first_page << 12;
+ bar_offset = mmio_start_phys & (pci_resource_len(pdev, range_id) - 1);
+ ipa_start = r->start + bar_offset;
+ ipa_end = ipa_start + (mmio_range->num_pages << 12);
+
+ if (!validate)
+ ret = rsi_invalidate_dev_mapping(ipa_start, ipa_end);
+ if (ret)
+ return ret;
+ }
+ return 0;
+}
diff --git a/drivers/virt/coco/arm-cca-guest/rsi-da.h b/drivers/virt/coco/arm-cca-guest/rsi-da.h
index fa9cc01095da..32cf90beb55e 100644
--- a/drivers/virt/coco/arm-cca-guest/rsi-da.h
+++ b/drivers/virt/coco/arm-cca-guest/rsi-da.h
@@ -12,6 +12,28 @@
#define MAX_CACHE_OBJ_SIZE SZ_16M
+struct pci_tdisp_device_interface_report {
+ u16 interface_info;
+ u16 reserved;
+ u16 msi_x_message_control;
+ u16 lnr_control;
+ u32 tph_control;
+ u32 mmio_range_count;
+} __packed;
+
+struct pci_tdisp_mmio_range {
+ u64 first_page;
+ u32 num_pages;
+ u32 range_attributes;
+} __packed;
+
+#define TSM_INTF_REPORT_MMIO_MSIX_TABLE BIT(0)
+#define TSM_INTF_REPORT_MMIO_PBA BIT(1)
+#define TSM_INTF_REPORT_MMIO_IS_NON_TEE BIT(2)
+#define TSM_INTF_REPORT_MMIO_IS_UPDATABLE BIT(3)
+#define TSM_INTF_REPORT_MMIO_RESERVED GENMASK(15, 4)
+#define TSM_INTF_REPORT_MMIO_RANGE_ID GENMASK(31, 16)
+
struct cca_guest_dsc {
struct pci_tsm_devsec pci;
void *interface_report;
@@ -42,5 +64,5 @@ int cca_device_unlock(struct pci_dev *pdev);
int cca_update_device_object_cache(struct pci_dev *pdev, struct cca_guest_dsc *dsc);
struct page *alloc_shared_pages(int nid, gfp_t gfp_mask, unsigned long min_size);
int free_shared_pages(struct page *page, unsigned long min_size);
-
+int cca_apply_interface_report_mappings(struct pci_dev *pdev, bool validate);
#endif
--
2.43.0On Mon, 17 Nov 2025 19:30:03 +0530
"Aneesh Kumar K.V (Arm)" <aneesh.kumar@kernel.org> wrote:
> Parse the TDISP device interface report and drive the RSI
> RDEV_VALIDATE_MAPPING handshake for each Realm MMIO window. The new
> helper walks the reported ranges, rejects malformed entries, and either
> validates the IPA->PA mapping when the device transitions to RUN or tears
> it down with RIPAS updates on unlock.
>
> Signed-off-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>
A few minor things in here.
> diff --git a/drivers/virt/coco/arm-cca-guest/rsi-da.c b/drivers/virt/coco/arm-cca-guest/rsi-da.c
> index aa6e13e4c0ea..c70fb7dd4838 100644
> --- a/drivers/virt/coco/arm-cca-guest/rsi-da.c
> +++ b/drivers/virt/coco/arm-cca-guest/rsi-da.c
> +int cca_apply_interface_report_mappings(struct pci_dev *pdev, bool validate)
> +{
> + int ret;
> + struct resource *r;
> + unsigned int range_id;
> + phys_addr_t mmio_start_phys;
> + struct pci_tdisp_mmio_range *mmio_range;
> + phys_addr_t ipa_start, ipa_end, bar_offset;
> + struct pci_tdisp_device_interface_report *interface_report;
> + struct cca_guest_dsc *dsc = to_cca_guest_dsc(pdev);
> +
> + interface_report = (struct pci_tdisp_device_interface_report *)dsc->interface_report;
> + mmio_range = (struct pci_tdisp_mmio_range *)(interface_report + 1);
> +
> +
> + for (int i = 0; i < interface_report->mmio_range_count; i++, mmio_range++) {
> +
I would make scope of some of the variables used in here explicit by declaring them in the loop.
e.g. range_id.
> + range_id = FIELD_GET(TSM_INTF_REPORT_MMIO_RANGE_ID, mmio_range->range_attributes);
> +
I would drop this blank line. Keep the variable set and error check tightly together.
> + if (range_id >= PCI_NUM_RESOURCES) {
> + pci_warn(pdev, "Skipping broken range [%d] #%d %d\n",
> + i, range_id, mmio_range->num_pages);
> + continue;
> + }
> +
> + r = pci_resource_n(pdev, range_id);
> +
Likewise I would drop this blank line.
> + if (r->end == r->start ||
> + resource_size(r) & ~PAGE_MASK || !mmio_range->num_pages) {
Seems like an odd wrap.
if (r->end == r->start ||
resource_size(r) & ~PAGE_MASK ||
!mmio_range->num_pages) {
or
if (r->end == r->start || resource_size(r) & ~PAGE_MASK ||
!mmio_range->num_pages) {
Only exception being if you are going to edit this in a patch soon after and this
is about avoiding churn in that patch - if so ignore this comment.
> + pci_warn(pdev, "Skipping broken range [%d] #%d %d pages, %llx..%llx\n",
> + i, range_id, mmio_range->num_pages, r->start, r->end);
> + continue;
> + }
> +
> + if (FIELD_GET(TSM_INTF_REPORT_MMIO_IS_NON_TEE, mmio_range->range_attributes)) {
> + pci_info(pdev, "Skipping non-TEE range [%d] #%d %d pages, %llx..%llx\n",
> + i, range_id, mmio_range->num_pages, r->start, r->end);
> + continue;
> + }
> +
> + /* No secure interrupts, we should not find this set, ignore for now. */
> + if (FIELD_GET(TSM_INTF_REPORT_MMIO_MSIX_TABLE, mmio_range->range_attributes) ||
> + FIELD_GET(TSM_INTF_REPORT_MMIO_PBA, mmio_range->range_attributes)) {
> + pci_info(pdev, "Skipping MSIX (%ld/%ld) range [%d] #%d %d pages, %llx..%llx\n",
> + FIELD_GET(TSM_INTF_REPORT_MMIO_MSIX_TABLE, mmio_range->range_attributes),
> + FIELD_GET(TSM_INTF_REPORT_MMIO_PBA, mmio_range->range_attributes),
> + i, range_id, mmio_range->num_pages, r->start, r->end);
> + continue;
> + }
> +
> + /* units in 4K size*/
> + mmio_start_phys = mmio_range->first_page << 12;
> + bar_offset = mmio_start_phys & (pci_resource_len(pdev, range_id) - 1);
> + ipa_start = r->start + bar_offset;
> + ipa_end = ipa_start + (mmio_range->num_pages << 12);
> +
> + if (!validate)
> + ret = rsi_invalidate_dev_mapping(ipa_start, ipa_end);
> + if (ret)
> + return ret;
> + }
> + return 0;
> +}
> diff --git a/drivers/virt/coco/arm-cca-guest/rsi-da.h b/drivers/virt/coco/arm-cca-guest/rsi-da.h
> index fa9cc01095da..32cf90beb55e 100644
> --- a/drivers/virt/coco/arm-cca-guest/rsi-da.h
> +++ b/drivers/virt/coco/arm-cca-guest/rsi-da.h
> @@ -12,6 +12,28 @@
> struct cca_guest_dsc {
> struct pci_tsm_devsec pci;
> void *interface_report;
> @@ -42,5 +64,5 @@ int cca_device_unlock(struct pci_dev *pdev);
> int cca_update_device_object_cache(struct pci_dev *pdev, struct cca_guest_dsc *dsc);
> struct page *alloc_shared_pages(int nid, gfp_t gfp_mask, unsigned long min_size);
> int free_shared_pages(struct page *page, unsigned long min_size);
> -
Check all patches for noise like this. Either that white space is good to have in which case
keep it. Or it's not in which case delete.
> +int cca_apply_interface_report_mappings(struct pci_dev *pdev, bool validate);
> #endif
© 2016 - 2025 Red Hat, Inc.