[RFC PATCH kernel 00/17] PCI/TSM: coco/sev-guest: Implement SEV-TIO PCIe TDISP (phase2)

[Alexey Kardashevskiy <aik@amd.com>]

Here are some patches to continue enabling SEV-TIO on AMD.

SEV-TIO allows guests to establish trust in a device that supports TEE
Device Interface Security Protocol (TDISP, defined in PCIe r6.0+) and
then interact with the device via private memory.

In order to streamline upstreaming process, a common TSM infrastructure
is being developed in collaboration with Intel+ARM+RiscV. There is
Documentation/driver-api/pci/tsm.rst with proposed phases:
1. IDE: encrypt PCI, host only
2. TDISP in guest: lock + accept flow, interface report <= WE ARE HERE
3. Enable on host: secure MMIO + DMA, KVM changes
4. Device attestation: certificates, measurements


Acronyms:
TEE - Trusted Execution Environments, a concept of managing trust between the host and devices
TSM - TEE Security Manager (TSM), an entity which ensures security on the host
PSP - AMD platform secure processor (also "ASP", "AMD-SP"), acts as TSM on AMD.
SEV TIO - the TIO protocol implemented by the PSP and used by the host, extension to SEV-SNP
GHCB - guest/host communication block - a protocol for guest-to-host communication via a shared page
TDISP - TEE Device Interface Security Protocol (PCIe).



Flow:
- Boot guest OS, load sev-guest.ko which registers itself as a TSM
- PCI TSM creates sysfs nodes under "tsm" subdirectory in for all
  TDISP-capable devices
- lock the device via:
	echo tsm0 > "/sys/bus/pci/devices/0000:01:00.0/tsm/lock"
- accept the device via:
	echo 1 > "/sys/bus/pci/devices/0000:01:00.0/tsm/accept"
- load the device driver:
	- DMA to encrypted memory should work right away
	- Reported TEE MMIO regions will be mapped as encrypted


Patches 01/17..05/17 are fixes and can go in sooner.
Patches 06/17..17/17 are the minimum required by the VM to get encrypted MMIO and DMA.

Doing "io_tlb_default_mem.for_alloc = true" in swiotlb_init_remap() enabled T=1 DMA
to shared guest memory.


The previous conversation is here:
https://lore.kernel.org/r/20260225053806.3311234-1-aik@amd.com

This is based on the last Dan's patch series rebased on top of
v7.3-rc2 with the DMA SWIOTLB fixes from Aneesh.

The whole tree is here: https://github.com/AMDESE/linux-kvm/commits/tsm-next/
The host support is here: https://github.com/AMDESE/linux-kvm/commits/tsm
Some raw QEMU sketch is here: https://github.com/AMDESE/qemu/commits/tsm-next

Please comment. Thanks.


The SEV TIO spec:
https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/specifications/58271.pdf



Alexey Kardashevskiy (16):
  pci/dma/tsm: Call disable DMA bus hook on cleanup
  pci/tsm: Fix stale comment about TDI report range start
  tsm/core: Store range_id in pci_tsm_mmio_entry
  crypto/ccp/tsm: Use TSM API for DOE
  tsm-core: Register nevertheless
  x86/io/tsm: Allow mixed ioremap for shared+private BARs
  x86/dma: Revert "x86: Remove unnecessary architecture-specific
    <asm/device.h>"
  x86/dma: Add ARCH_HAS_PHYS_TO_DMA
  dma/swiotlb: Force shared DMA for allocatios from SWIOTLB
  tsm/core: Add TDI status
  coco/sev-guest: Allow multiple source files in the driver
  x86/sev: Pass HV features to sev-guest device via platform data
  x86/sev: Add GHCB calls for SEV-TIO
  x86/sev: Implement guest TSM driver for SEV-TIO (phase2, DMA)
  x86/sev: Enable secure MMIO (phase2)
  x86/sev: Flush IOMMU TLB for trusted devices

Dan Williams (1):
  x86, dma: Allow accepted devices to map private memory

 arch/x86/Kconfig                                    |   1 +
 drivers/virt/coco/sev-guest/Kconfig                 |   1 +
 drivers/virt/coco/sev-guest/Makefile                |   5 +-
 arch/x86/include/asm/device.h                       |  13 +
 arch/x86/include/asm/dma-direct.h                   |  77 +++
 arch/x86/include/asm/sev-common.h                   |   3 +
 arch/x86/include/asm/sev.h                          |  13 +
 arch/x86/include/uapi/asm/svm.h                     |  43 ++
 drivers/virt/coco/sev-guest/sev-guest.h             |  20 +
 include/linux/dma-direct.h                          |   2 +-
 include/linux/io.h                                  |   8 +
 include/linux/ioport.h                              |   3 +
 include/linux/pci-tsm.h                             |  71 ++
 include/uapi/linux/sev-guest.h                      |  12 +
 arch/x86/coco/sev/core.c                            | 148 +++-
 arch/x86/mm/ioremap.c                               |   2 +-
 arch/x86/mm/mem_encrypt.c                           |   5 +-
 drivers/crypto/ccp/sev-dev-tsm.c                    |   5 +-
 drivers/pci/pci-driver.c                            |   3 +
 drivers/pci/tsm/core.c                              |   3 +-
 drivers/virt/coco/sev-guest/{sev-guest.c => core.c} |  25 +-
 drivers/virt/coco/sev-guest/tio.c                   | 725 ++++++++++++++++++++
 drivers/virt/coco/tsm-core.c                        |  16 +-
 drivers/xen/swiotlb-xen.c                           |   2 +-
 kernel/dma/direct.c                                 |   3 +-
 kernel/dma/swiotlb.c                                |   2 +-
 kernel/resource.c                                   |  63 ++
 mm/ioremap.c                                        |   2 +-
 28 files changed, 1249 insertions(+), 27 deletions(-)
 create mode 100644 arch/x86/include/asm/device.h
 create mode 100644 arch/x86/include/asm/dma-direct.h
 create mode 100644 drivers/virt/coco/sev-guest/sev-guest.h
 rename drivers/virt/coco/sev-guest/{sev-guest.c => core.c} (97%)
 create mode 100644 drivers/virt/coco/sev-guest/tio.c

-- 
2.55.0