Re: [PATCH 06/15] PCI/TSM: Add device evidence support

["Dan Williams (nvidia)" <djbw@kernel.org>]

Alexey Kardashevskiy wrote:
> On 6/7/26 08:08, Dan Williams wrote:
> > Register the PCI Trusted Execution Environment Security Manager (TSM)
> > framework with the device-evidence netlink ABI. The security operations
> > that PCI core coordinates with a device security manager (DSM) through a
> > platform TEE security manager (TSM), builds upon the SPDM protocol.
> > 
> > A TSM owns an SPDM session and publishes the corresponding evidence through
> > TSM firwmware ABIs. A low level TSM driver is responsible for creating a
> > 'struct device_evidence' context and carrying out refresh_evidence()
> 
> 
> a nit: so it is really refresh_measurements() as it won't refresh the report? may be call it so?

Sure.

> > requests for regenerating measurement transcripts with a nonce.
[..]
> > diff --git a/include/linux/pci-tsm.h b/include/linux/pci-tsm.h
> > index a6435aba03f9..8bc16029d31e 100644
> > --- a/include/linux/pci-tsm.h
> > +++ b/include/linux/pci-tsm.h
> > @@ -3,7 +3,10 @@
> >   #define __PCI_TSM_H
> >   #include <linux/mutex.h>
> >   #include <linux/pci.h>
> > +#include <linux/rwsem.h>
> 
> then this file is missing extern struct rw_semaphore pci_tsm_rwsem;

This include was a mistake. pci_tsm_rwsem is private to
drivers/pci/tsm/, so I will remove this include. This is the only shared
data structure between drivers/pci/tsm/core.c and
drivers/pci/tsm/evidence.c. It could go go in a
drivers/pci/tsm/private.h, but given just the one declaration have
evidence.c do it directly.

> >   #include <linux/sockptr.h>
> > +#include <linux/tsm.h>
> > +#include <linux/device/evidence.h>
> >   
> >   struct pci_tsm;
> >   struct tsm_dev;
> > @@ -18,6 +21,7 @@ enum pci_tsm_req_scope;
> >    * @devsec_ops: Lock, unlock, and interrogate the security state of the
> >    *		function via the platform TSM (typically virtual function
> >    *		operations).
> > + * @refresh_evidence: Common operation to regenerate attestation objects
> >    *
> >    * This operations are mutually exclusive either a tsm_dev instance
> >    * manages physical link properties or it manages function security
> > @@ -75,6 +79,9 @@ struct pci_tsm_ops {
> >   					struct pci_dev *pdev);
> >   		void (*unlock)(struct pci_tsm *tsm);
> >   	);
> > +
> > +	int (*refresh_evidence)(struct pci_tsm *tsm, const void *nonce,
> > +				size_t nonce_len);
> >   };
> >   
> >   /**
[..]
> > @@ -216,6 +226,10 @@ void pci_tsm_tdi_constructor(struct pci_dev *pdev, struct pci_tdi *tdi,
> >   ssize_t pci_tsm_guest_req(struct pci_dev *pdev, enum pci_tsm_req_scope scope,
> >   			  sockptr_t req_in, size_t in_len, sockptr_t req_out,
> >   			  size_t out_len, u64 *tsm_code);
> > +static inline const struct pci_tsm_ops *to_pci_tsm_ops(struct pci_tsm *tsm)
> > +{
> > +	return tsm->tsm_dev->pci_ops;
> > +}
> >   #else
> >   static inline int pci_tsm_register(struct tsm_dev *tsm_dev)
> >   {
> > diff --git a/drivers/pci/tsm.c b/drivers/pci/tsm/core.c
> > similarity index 99%
> > rename from drivers/pci/tsm.c
> > rename to drivers/pci/tsm/core.c
> 
> This move + related makefile changes + exposing pci_tsm_rwsem are better be in a separate patch. Thanks,

I'll do a prep patch.