Re: [RFC PATCH v1 03/11] attestation: Enter secure operation when evidence is accepted

[Jiri Pirko <jiri@resnulli.us>]

Wed, Oct 28, 2026 at 04:26:10PM +0100, aneesh.kumar@kernel.org wrote:
>Use EVIDENCE_ACCEPT to enter secure operation after userspace has
>checked the evidence. Check the referenced device and evidence
>generations before calling the driver, and record acceptance on success.
>
>Remove the separate DEVSEC_RUN command and callback.
>
>Keep DEVSEC_STATE_GET so userspace can read both evidence acceptance and
>device state. Clearing acceptance does not undo the device state change.
>For example, with the following PCI/TSM patches:

Note that the published wip_attestation_all_1 baseline still
has DEVSEC_RUN. I am planning this merge into EVIDENCE_ACCEPT for
my next revision, which is not pushed yet.


>
>  Operation              Evidence acceptance  TDISP state
>  ---------------------  -------------------  -----------
>  EVIDENCE_ACCEPT        Recorded             RUN
>  EVIDENCE_ACCEPT_CLEAR  Cleared              RUN
>
>After EVIDENCE_ACCEPT_CLEAR, DEVSEC_STATE_GET omits the accepted
>evidence generation but still reports TDISP RUN.

What exactly is the clear good for now?



[..]


>-int ctlv_attestation_devsec_run_action(void *priv, struct ctlv_op_ctx *ctx,
>-				       const struct ctlv_cursor *request, struct ctlv_cursor *reply)
>-{
>-	struct attestation_event_batch events = {};
>-	struct attestation *att = priv;
>-	u64 device, evidence;
>-	int ret;
>-
>-	device = ctlv_attestation_devsec_run_device_generation_get(request);
>-	evidence = ctlv_attestation_devsec_run_evidence_generation_get(request);
>-	if (device > UINT_MAX || evidence > UINT_MAX)
>-		return -ESTALE;
>-	if (!att->verdict_recorded || att->accepted_device_generation != device ||
>-	    att->accepted_evidence_generation != evidence)
>-		return -ESTALE;
>-	ret = attestation_evidence_validate(att, device, evidence);
>-	if (ret)
>-		return ret;
>-	ret = attestation_preflight(att, true, false, false);
>-	if (ret)
>-		return ret;
>-	ret = attestation_events_prepare(att, &events, true, true, false);
>-	if (ret)
>-		return ret;
>-	ret = att->provider->devsec_run(att);
>-	if (ret)
>-		goto out;
>-	attestation_device_changed(att);
>-	attestation_device_event_emit(&events, att->device_generation);
>-	attestation_evidence_event_emit(&events, att);
>-	if (!ctlv_attestation_device_generation_put(reply, att->device_generation))
>-		ret = -EMSGSIZE;
>-out:
>-	attestation_events_abort(&events);

As this function performed generation preflight, advancing
device-generation, emitting the device and evidence events, and
returning the new generation, I think that this bookkeeping needs to
move to evidence_accept function.

[..]