Re: [PATCH 00/15] Device Evidence and Trust for PCI Security Protocol (TDISP)

[Alexey Kardashevskiy <aik@amd.com>]

On 6/7/26 08:08, Dan Williams wrote:
> Major changes since: "[PATCH v2 00/19] PCI/TSM: TEE I/O infrastructure" [1]

soo with the recent sudden sad news about Dan, I do not know where to start really so I just start...

Here is his unfinished work which I'd really like to see finished to progress with the phase2 of the plan. How do we proceed from now on?

The direction appears to be set, imho the immediate TODO list is:
- address "not-netlink-y enough" concerns
- teach pci_iomap() to map mixed private+shared BARs (ones which contain MSIX for the starter)
- always call pci_tsm_ops::enable_dma/disable_dma
- ditch the module trust parameter?
- add a knob to enable/disable DMA and keep TDI in RUN

Any volunteers? Yilun, Aneesh, Jason?

Which maintainer's tree is this going to go to?

I am happy to amend the patches for the time being, and do the testing on my HW, and posting.

And we are going to continue running the bi-weekly TSM+IOMMUFD community call (Thursday evening in the USA) so we can talk this through then, the next one on August 6th:

https://zoom-lfx.platform.linuxfoundation.org/meeting/93219227394?password=80705486-101a-4e19-8f11-0baaf92104be

Thanks,




> - Implement a new netlink schema for dumping large SPDM blobs (Jakub,
>    Lukas)
> - Introduce a device core implementation for evidence gathering given
>    SPDM is applicable to devices outside of PCI (Lukas)
> - Replace the "CC acceptance" mechanism with "Device Trust" (Greg,
>    Jason)
> - Fix TDISP report parsing to use bytes instead of pfns for the start
>    value of an MMIO report (PCI spec clarification)
> - Support the CCA expectation that MMIO reports are BAR aligned (Aneesh)
> 
> [1]: http://lore.kernel.org/20260303000207.1836586-1-dan.j.williams@intel.com
> 
> [ Note, this series is back to a v1 posting given the new theme of
>    "Evidence and Trust". It defers some of the lower level details, like
>    touching arch-level ioremap implementations to consult encrypted_iomem,
>    until the higher order details are settled ].
> 
> ---
> Summary:
> A threat model wants to arrange for devices to not be operated until
> they present evidence. Add device evidence gathering, device trust
> levels, and hook those up for the PCI/TSM (PCI device security protocol)
> implementation.
> ---
> 
> Confidential Computing and other use cases specify a threat model where
> devices are potentially adversarial. To date the device core trusts
> devices and their drivers, and only specific buses have local
> "adversary" device mitigations. The task is define a general trust
> concept to up-level existing trust mitigations, and allow for
> incremental tightening of mitigations across bus types and IOMMU
> drivers.
> 
> Goals:
> * Create a mechanism for booting with a limited set
>    devices + drivers and permit selectively enabling more devices +
>    drivers at runtime.
> * Up-level bus specific trust mitigations like PCI
>    untrusted to a core concept.
> * Let buses coordinate entry into the TCB via the existing
>    ->dma_configure() callback
> 
> The proposal considers existing trust mitigation in various buses.  The
> PCI device "untrusted" flags is an example of limiting but not fully
> blocking operation of a device. The USB interface authorized flag is an
> example of not trusting a device to operate at all. The implementation
> starts with these trust level DEVICE_TRUST_NONE, no operation of the
> device, and DEVICE_TRUST_ADVERSARY, limited operation of the device.
> For example, the PCI "untrusted" flag turns off device translation
> capabilities (ATS) and strictly enforces IOMMU mappings, but otherwise
> allows operation of the device.
> 
> The proposal does not currently incorporate other bus specific security
> mechanisms that are independent of individual device operational trust.
> For example, USB device (not interface) authorization and Thunderbolt
> switch authorization are transport gates to other devices.  PCIe Link
> Encryption is also a transport security mechanism that informs a trust
> decision, but it is still possible to distrust a device with Link
> Encryption and conversely distrust a device protected by Link
> Encryption. Those security mechanisms are orthogonal to trust policy for
> driver bind, address space access, and acceleration feature enabling.
> 
> The result is device trust is an input to the driver core and IOMMU
> layers. A bus can opt to sync its local bind policy, address space
> access, and acceleration features to the trust level, or treat it as an
> overriding second-stage policy from the bus's first stage mechanism.
> 
> The trust levels established at enumeration and enforced at driver
> attach are DEVICE_TRUST_{NONE,ADVERSARY,AUTO,TCB}:
> 
> * NONE: no usage of the device unless the trust is explicitly overridden
>    by user policy specified via a driver flag, module flag, or uapi (TBD).
> 
> * ADVERSARY: needs acknowledgement from the bus and IOMMU / DMA layers
>    that the device is limited to strict IOMMU translation behavior. Drivers
>    can use this as a signal to limit functionality. This designation
>    implies follow-on IOMMU and bus enabling work for features like
>    arranging for the device to attach to a blocked IOMMU domain when
>    detached from a driver.
> 
> * AUTO: typical / historical Linux driver model.
> 
> * TCB: a trust level that only exists in Confidential Computing
>    environments. When acked by the IOMMU / DMA layer it enables the device
>    to issue direct-DMA to private/encrypted addresses or otherwise attach to
>    a secure vIOMMU within the TCB.
> 
> Overview of changes:
> Patches 1-6: Update netlink to be able to support large blob
> transfers that the SPDM standard requires. SPDM can be associated with
> any device type, so the implementation lands in the device core with
> PCI/TSM as the first consumer.
> 
> Patches 7-9: Introduce DEVICE_TRUST_NONE and DEVICE_TRUST_ADVERSARY.
> Support blocking driver bind by default, and allow either build policy
> or module policy to override the the trust level.
> 
> Patches 10-12,14-15: Plumb the PCI/TSM support for the PCI device
> security (TDISP) protocol to transition the device through
> UNLOCKED->LOCKED->RUN.
> 
> Patch 13: Support access to private memory either by the bus either
> coordinating with a TSM driver, or relying on the bus provider to have
> already arranged access (paravisor case).
> 
> This passes basic checkout with the sample TSM driver and a sample
> netlink client for the device evidence facility. Those patches are only
> on the git tree for now [2].
> 
> [2]: https://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm.git/log/?h=devsec-phase2
> 
> Dan Williams (15):
>    netlink: specs: Introduce multi-message blobs for SPDM
>    tools: ynl: Teach pyynl to handle blobs
>    tools: ynl: Teach ynl_gen_c to validate and dump 'blob' attributes
>    device core: Introduce "device evidence" over netlink
>    device core: Add "device evidence" 'validate' command
>    PCI/TSM: Add device evidence support
>    modules: Document the global async_probe parameter
>    device core: Initial device trust infrastructure
>    PCI, device core: Move "untrusted" concept to DEVICE_TRUST_ADVERSARY
>    PCI/TSM: Add device interface security LOCKED support
>    PCI/TSM: Add device interface security RUN support
>    PCI/TSM: Add device interface security DMA enable/disable
>    PCI, device core: Add private memory access for DEVICE_TRUST_TCB
>    PCI/TSM: Create MMIO descriptors via TDISP Report
>    PCI/TSM: Add relative MMIO offset support?
> 
>   drivers/base/Kconfig                          |  91 +++
>   drivers/pci/Kconfig                           |   2 +
>   drivers/base/Makefile                         |   2 +
>   drivers/pci/Makefile                          |   2 +-
>   drivers/pci/tsm/Makefile                      |   8 +
>   Documentation/ABI/stable/sysfs-module         |  17 +
>   Documentation/ABI/testing/sysfs-bus-pci       |  47 +-
>   Documentation/ABI/testing/sysfs-class-tsm     |  19 +
>   Documentation/driver-api/pci/tsm.rst          |  47 ++
>   Documentation/netlink/genetlink-legacy.yaml   |   6 +
>   Documentation/netlink/genetlink.yaml          |   7 +
>   Documentation/netlink/netlink-raw.yaml        |   7 +
>   .../netlink/specs/device-evidence.yaml        | 203 ++++++
>   drivers/base/base.h                           |  15 +
>   drivers/base/device-evidence-netlink.h        |  25 +
>   include/linux/device.h                        |   3 +
>   include/linux/device/evidence.h               |  88 +++
>   include/linux/device/trust.h                  |  56 ++
>   include/linux/ioport.h                        |   2 +
>   include/linux/module.h                        |   6 +-
>   include/linux/pci-tsm.h                       | 104 +++-
>   include/linux/pci.h                           |  13 +-
>   include/uapi/linux/device-evidence.h          | 111 ++++
>   tools/net/ynl/lib/ynl-priv.h                  |   4 +
>   tools/net/ynl/lib/ynl.h                       |  14 +
>   drivers/base/core.c                           |   7 +
>   drivers/base/dd.c                             |   5 +
>   drivers/base/device-evidence-netlink.c        |  58 ++
>   drivers/base/evidence.c                       | 495 +++++++++++++++
>   drivers/base/trust.c                          | 103 ++++
>   drivers/iommu/amd/iommu.c                     |   2 +-
>   drivers/iommu/dma-iommu.c                     |  13 +-
>   drivers/iommu/intel/iommu.c                   |   2 +-
>   drivers/iommu/iommu.c                         |   2 +-
>   drivers/pci/ats.c                             |   2 +-
>   drivers/pci/pci-driver.c                      |  25 +-
>   drivers/pci/pci.c                             |   2 +-
>   drivers/pci/probe.c                           |  10 +-
>   drivers/pci/quirks.c                          |   4 +-
>   drivers/pci/{tsm.c => tsm/core.c}             | 579 +++++++++++++++++-
>   drivers/pci/tsm/evidence.c                    | 110 ++++
>   drivers/virt/coco/tsm-core.c                  |  43 +-
>   kernel/module/main.c                          |  13 +
>   kernel/resource.c                             |   8 +
>   tools/net/ynl/lib/ynl.c                       |  33 +
>   MAINTAINERS                                   |   6 +-
>   tools/net/ynl/pyynl/lib/nlspec.py             |  12 +
>   tools/net/ynl/pyynl/lib/ynl.py                |  62 +-
>   tools/net/ynl/pyynl/ynl_gen_c.py              |  80 ++-
>   49 files changed, 2509 insertions(+), 66 deletions(-)
>   create mode 100644 drivers/pci/tsm/Makefile
>   create mode 100644 Documentation/netlink/specs/device-evidence.yaml
>   create mode 100644 drivers/base/device-evidence-netlink.h
>   create mode 100644 include/linux/device/evidence.h
>   create mode 100644 include/linux/device/trust.h
>   create mode 100644 include/uapi/linux/device-evidence.h
>   create mode 100644 drivers/base/device-evidence-netlink.c
>   create mode 100644 drivers/base/evidence.c
>   create mode 100644 drivers/base/trust.c
>   rename drivers/pci/{tsm.c => tsm/core.c} (61%)
>   create mode 100644 drivers/pci/tsm/evidence.c
> 
> 
> base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482

-- 
Alexey