linux-kernel - Re: [PATCH V3] PCI: pciehp: Disable ACS Source Validation during hot-remove

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230730194026.GA19962@wunner.de>
Date:   Sun, 30 Jul 2023 21:40:26 +0200
From:   Lukas Wunner <lukas@...ner.de>
To:     Vidya Sagar <vidyas@...dia.com>
Cc:     bhelgaas@...gle.com, alex.williamson@...hat.com,
        treding@...dia.com, jonathanh@...dia.com,
        linux-pci@...r.kernel.org, linux-kernel@...r.kernel.org,
        vsethi@...dia.com, kthota@...dia.com, mmaddireddy@...dia.com,
        sagar.tv@...il.com
Subject: Re: [PATCH V3] PCI: pciehp: Disable ACS Source Validation during
 hot-remove

On Mon, Jul 31, 2023 at 12:45:19AM +0530, Vidya Sagar wrote:
> PCIe 6.0, 6.12.1.1 specifies that downstream devices are permitted to
> send upstream messages before they have been assigned a bus number and
> such messages have a Requester ID with Bus number set to 00h.
> If the Downstream port has ACS Source Validation enabled, these messages
> will be detected as ACS violation error.
> 
> Hence, disable ACS Source Validation in the bridge device during
> hot-remove operation and re-enable it after enumeration of the
> downstream hierarchy but before binding the respective device drivers.

What are these messages that are sent before assignment of a bus number?

What's the user-visible issue that occurs when they're blocked?

Doesn't disabling Source Validation introduce a security hole because the
device may spoof messages before Source Validation is re-enabled?

PCIe r6.1 sec 6.12.1.1 does indeed point out that the downstream device
is *permitted* to send these messages but the Implementation Note
does *not* prescribe that Source Validation shall be disabled to let them
through.  It merely points out that the messages may be filtered if
Source Validation is enabled.

Thanks,

Lukas