Re: [PATCH 13/15] PCI, device core: Add private memory access for DEVICE_TRUST_TCB

[Alexey Kardashevskiy <aik@amd.com>]

On 9/7/26 16:32, Alexey Kardashevskiy wrote:
> On 6/7/26 08:08, Dan Williams wrote:
>> A device that wants to access private memory needs to have its trust
>> elevated to DEVICE_TRUST_TCB. That trust is established either at compile
>> time (unlikely), the bus knows the device is within the TCB to start (some
>> paravisor setups), or the device is dynamically added to the TCB in
>> coordination with a TSM driver (primary TDISP use case) and the trust is
>> elevated by driver match.
>>
>> When a PCI device is associated with a TSM for security services the low
>> level TSM driver in the CC VM has the opportunity validate DMA access.
>> That validation happens at ->dma_configure() time when the device attaches
>> to a driver. The TSM driver is responsible for proving to the platform TSM
>> that the VM is enabling DMA with respect to the most recently generated
>> evidence. If that fails, driver attach fails.
>>
>> When a PCI device is not associated with a TSM provider for security
>> services, but the device is trusted there are 3 options.
>>
>> 1/ Arch requires all DMA enable events to be acked by TSM driver
>>
>> 2/ Arch does not require, but admin policy is responsible for knowing which
>>     devices need TSM coordination to become active within the TCB.
>>
>> 3/ Device is approved by a paravisor to operate within the TCB, no TSM
>>     coordination required.
>>
>> In cases 2 and 3 if the device needed TSM driver coordination, but the TSM
>> driver or association to the device is missing, it triggers hardware
>> errors. Those errors are a configuration error that the kernel does not
>> actively prevent.
>>
>> Architectures still need to fixup force_dma_unencrypted() to call
>> device_tcb_trusted() to tell the DMA layer that TCB access is granted.
>>
>> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>> Cc: "Rafael J. Wysocki" <rafael@kernel.org>
>> Cc: Danilo Krummrich <dakr@kernel.org>
>> Cc: Bjorn Helgaas <bhelgaas@google.com>
>> Cc: Dexuan Cui <decui@microsoft.com>
>> Signed-off-by: Dan Williams <djbw@kernel.org>
>> ---
>>   drivers/base/Kconfig         | 19 ++++++++++++++++++-
>>   include/linux/device/trust.h |  4 ++++
>>   drivers/base/trust.c         |  8 ++++++++
>>   drivers/pci/pci-driver.c     | 25 ++++++++++++++++---------
>>   4 files changed, 46 insertions(+), 10 deletions(-)
>>
>> diff --git a/drivers/base/Kconfig b/drivers/base/Kconfig
>> index a4233bdf9804..3597b39ee0e3 100644
>> --- a/drivers/base/Kconfig
>> +++ b/drivers/base/Kconfig
>> @@ -304,7 +304,17 @@ config DEVICE_TRUST_AUTO
>>       help
>>         Typical historical driver model, devices eagerly attempt to attach to
>>         a driver and deploy all available mechanisms to allow performant
>> -      direct memory access.
>> +      direct memory access. This trust level does not include TCB privileges.
>> +
>> +config DEVICE_TRUST_TCB
>> +    bool "TCB"
>> +    depends on EXPERT
>> +    help
>> +      Devices are assumed to be within the Trusted Compute Boundary (TCB)
>> +      with access to private TCB resources by default. This requires buses
>> +      to have trust awareness and opt devices out of private operation,
>> +      otherwise TCB integrity may fail the device's access or escalate to
>> +      terminating the execution context (kill the CC VM).
>>   endchoice
>> @@ -330,6 +340,13 @@ config BUILTIN_DEVICE_TRUST_ADVERSARY
>>       help
>>         Deploy mitigations in the IOMMU layer and driver to limit access.
>> +config BUILTIN_DEVICE_TRUST_TCB
>> +    bool "TCB"
>> +    depends on EXPERT
>> +    help
>> +      Devices bound by built-in drivers are assumed to be within the
>> +      Trusted Compute Boundary with access to private/encrypted memory.
>> +
>>   endchoice
>>   endmenu
>> diff --git a/include/linux/device/trust.h b/include/linux/device/trust.h
>> index 283d3196e5e6..24951f5c56ba 100644
>> --- a/include/linux/device/trust.h
>> +++ b/include/linux/device/trust.h
>> @@ -13,6 +13,7 @@
>>    * @DEVICE_TRUST_NONE: Blocked when idle, cannot bind
>>    * @DEVICE_TRUST_ADVERSARY: Blocked when idle, constrained when active.
>>    * @DEVICE_TRUST_AUTO: All typical privileges granted
>> + * @DEVICE_TRUST_TCB: AUTO privileges + private/encrypted memory access
>>    *
>>    * Devices flagged as adversarial are the ones that can potentially
>>    * execute DMA attacks and similar. They are typically connected through
>> @@ -25,11 +26,13 @@ enum device_trust {
>>       DEVICE_TRUST_NONE,
>>       DEVICE_TRUST_ADVERSARY,
>>       DEVICE_TRUST_AUTO,
>> +    DEVICE_TRUST_TCB,
>>   };
>>   #define DEVICE_DEFAULT_TRUST \
>>       (IS_ENABLED(CONFIG_DEVICE_TRUST_NONE)      ? DEVICE_TRUST_NONE      : \
>>        IS_ENABLED(CONFIG_DEVICE_TRUST_ADVERSARY) ? DEVICE_TRUST_ADVERSARY : \
>> +     IS_ENABLED(CONFIG_DEVICE_TRUST_TCB)       ? DEVICE_TRUST_TCB       : \
>>        DEVICE_TRUST_AUTO)
>>   struct device;
>> @@ -37,6 +40,7 @@ struct device_driver;
>>   #ifdef CONFIG_DEVICE_TRUST
>>   bool device_untrusted(struct device *dev);
>> +bool device_tcb_trusted(struct device *dev);
>>   void module_driver_trust(struct module *mod, const char *val);
>>   void module_driver_trust_init(struct module *mod, bool require_trust);
>>   #else
>> diff --git a/drivers/base/trust.c b/drivers/base/trust.c
>> index 8efbe5c51250..21d374affbba 100644
>> --- a/drivers/base/trust.c
>> +++ b/drivers/base/trust.c
>> @@ -23,11 +23,18 @@ bool device_untrusted(struct device *dev)
>>       return dev->bus_trust && dev->bus_trust <= DEVICE_TRUST_ADVERSARY;
>>   }
>> +bool device_tcb_trusted(struct device *dev)
>> +{
>> +    return dev->p->trust >= DEVICE_TRUST_TCB;
>> +}
>> +
>>   /* Driver trust policy requires modules, builtin drivers always attach */
>>   static enum device_trust builtin_driver_trust(void)
>>   {
>>       if (IS_ENABLED(CONFIG_BUILTIN_DEVICE_TRUST_ADVERSARY))
>>           return DEVICE_TRUST_ADVERSARY;
>> +    else if (IS_ENABLED(CONFIG_BUILTIN_DEVICE_TRUST_TCB))
>> +        return DEVICE_TRUST_TCB;
> 
> 
> No plan to override this via the kernel cmdline?


Just tried - my test guest kernel has everything built-in. Since there is no module parameter - I did CONFIG_BUILTIN_DEVICE_TRUST_TCB=y. But now every driver gets this level, including virtio, which cannot ever be "TCB" (as anything emulated by QEMU). Thanks,


-- 
Alexey