Re: [PATCH 00/15] Device Evidence and Trust for PCI Security Protocol (TDISP)

[Lukas Wunner <lukas@wunner.de>]

[+cc Jonathan, start of thread is here:
https://lore.kernel.org/all/20260902150125.GD2890729@ziepe.ca/
]

On Wed, Sep 02, 2026 at 12:01:25PM -0300, Jason Gunthorpe wrote:
> In the short term I
> will volunteer to send patches (ie bug fixes!) to Linus in the CC area
> Dan was responsible for. Please email me if something needs some
> attention and we can figure it out.
> 
> To fully move forward we need to establish a new TSM maintainer
> team.

I created the "devsec" group on git.kernel.org a few years back
to host trees related to device security.  The first repository
of that group was spdm.git for the in-kernel SPDM implementation
and native PCI device authentication, with Jonathan and I as
co-maintainers:

https://git.kernel.org/pub/scm/linux/kernel/git/devsec/spdm.git/

Dan was added as third devsec maintainer to host tsm.git:

https://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm.git/

Jonathan and I retain access to both repositories.  I cannot speak
for Jonathan but I would be available to apply patches to tsm.git
and forward them to Linus.  It would also be possible of course to
add additional maintainers to the group.

> I've asked Jiri Pirko to work on
> the PCI evidence uAPI based on his deep netlink experience

netlink isn't well suited to transport large blobs because the nlattr
len is u16.  (The len of the enclosing nlmsg is u32, which is sufficient.)

Previous approaches, including the one proposed by Dan in this series,
work around the problem by splitting the blob into a sequence of nlattrs.
I think we should instead extend the netlink protocol with 32-bit "jumbo"
attributes.

I suggest we reserve bit 13 of nla_type as NLA_F_JUMBO and use the
the first 4 bytes after the struct nlattr header as length (if the
jumbo flag is set).


A second problem is that the size of a socket buffer's linear data
is limited.  Also, copying the blob into the nlmsg is a bit wasteful
and we'd want zero copy instead.  The solution I've come up with is
to attach the pages backing the blob as fragments to the skb.
It's very simple, overcomes the skb size limitation and allows for
zero-copy:

https://github.com/l1k/linux/commit/6e73bb999128

That commit is from January and the time I've been able to devote
to this has since been limited as my employer prioritized various
AER feature gaps and fixes.

I worked on this for native PCI device authentication, which faces
the same netlink blob issue as TSM-mediated authentication.
Both should use the same uABI for evidence exposure.  Additionally,
native device authentication may be used by non-PCI buses such as
ATA or SCSI.  The uABI should work for those use cases as well.

> This is the only time Europe could reasonably participate in,
> obviously it is not OK for China and Aus.

FWIW, I'm likewise based in Europe, as is Jonathan.

> > I find these calls pretty productive syncups. So
> > far we were not having Europe in these calls.

There is a CCC call at a US/Europe friendly time but the meeting
is usually canceled.  There was a single occasion in June when it
wasn't canceled but very few people showed up and in particular no
moderator showed up.  Dan said that someone at Google is responsible
for the meeting, I don't know who that is:

https://youtu.be/_cNgyfYlDGo?t=501


Obviously, one cannot separate discussing Dan's work from Dan.
It is still difficult to talk about either for people who were
close to him, and he was close to many.  Anyone who has lost
somebody dear to them knows that grieving and eventually
accepting loss is a process that can take years.
We're only at the beginning.

I've suggested a celebration of life for Dan at LPC, to complement
the service organized by his family last Sunday.  I am happy that
the organizers reacted positively:

https://lwn.net/Articles/1084564/

See you there!

Lukas