Re: [PATCH 06/15] PCI/TSM: Add device evidence support

[Alexey Kardashevskiy <aik@amd.com>]

On 6/7/26 08:08, Dan Williams wrote:
> Register the PCI Trusted Execution Environment Security Manager (TSM)
> framework with the device-evidence netlink ABI. The security operations
> that PCI core coordinates with a device security manager (DSM) through a
> platform TEE security manager (TSM), builds upon the SPDM protocol.
> 
> A TSM owns an SPDM session and publishes the corresponding evidence through
> TSM firwmware ABIs. A low level TSM driver is responsible for creating a
> 'struct device_evidence' context and carrying out refresh_evidence()


a nit: so it is really refresh_measurements() as it won't refresh the report? may be call it so?

> requests for regenerating measurement transcripts with a nonce.
> 
> Cc: Bjorn Helgaas <bhelgaas@google.com>
> Cc: Alistair Francis <alistair.francis@wdc.com>
> Cc: Lukas Wunner <lukas@wunner.de>
> Cc: Xu Yilun <yilun.xu@linux.intel.com>
> Cc: "Aneesh Kumar K.V (Arm)" <aneesh.kumar@kernel.org>
> Cc: Alexey Kardashevskiy <aik@amd.com>
> Signed-off-by: Dan Williams <djbw@kernel.org>
> ---
>   drivers/pci/Kconfig               |   1 +
>   drivers/pci/Makefile              |   2 +-
>   drivers/pci/tsm/Makefile          |   8 +++
>   include/linux/pci-tsm.h           |  14 ++++
>   drivers/pci/{tsm.c => tsm/core.c} |   9 +--
>   drivers/pci/tsm/evidence.c        | 110 ++++++++++++++++++++++++++++++
>   MAINTAINERS                       |   2 +-
>   7 files changed, 137 insertions(+), 9 deletions(-)
>   create mode 100644 drivers/pci/tsm/Makefile
>   rename drivers/pci/{tsm.c => tsm/core.c} (99%)
>   create mode 100644 drivers/pci/tsm/evidence.c
> 
> diff --git a/drivers/pci/Kconfig b/drivers/pci/Kconfig
> index 0c7408509ba2..ed17b5d2d5ae 100644
> --- a/drivers/pci/Kconfig
> +++ b/drivers/pci/Kconfig
> @@ -126,6 +126,7 @@ config PCI_IDE
>   
>   config PCI_TSM
>   	bool "PCI TSM: Device security protocol support"
> +	select DEVICE_EVIDENCE if NET
>   	select PCI_IDE
>   	select PCI_DOE
>   	select TSM
> diff --git a/drivers/pci/Makefile b/drivers/pci/Makefile
> index 41ebc3b9a518..211f195ff2c9 100644
> --- a/drivers/pci/Makefile
> +++ b/drivers/pci/Makefile
> @@ -35,7 +35,7 @@ obj-$(CONFIG_XEN_PCIDEV_FRONTEND) += xen-pcifront.o
>   obj-$(CONFIG_VGA_ARB)		+= vgaarb.o
>   obj-$(CONFIG_PCI_DOE)		+= doe.o
>   obj-$(CONFIG_PCI_IDE)		+= ide.o
> -obj-$(CONFIG_PCI_TSM)		+= tsm.o
> +obj-$(CONFIG_PCI_TSM)		+= tsm/
>   obj-$(CONFIG_PCI_DYNAMIC_OF_NODES) += of_property.o
>   obj-$(CONFIG_PCI_NPEM)		+= npem.o
>   obj-$(CONFIG_PCIE_TPH)		+= tph.o
> diff --git a/drivers/pci/tsm/Makefile b/drivers/pci/tsm/Makefile
> new file mode 100644
> index 000000000000..fd7ac2e862f1
> --- /dev/null
> +++ b/drivers/pci/tsm/Makefile
> @@ -0,0 +1,8 @@
> +# SPDX-License-Identifier: GPL-2.0
> +#
> +# Makefile for the PCI/TSM infrastructure
> +
> +obj-$(CONFIG_PCI_TSM) += tsm.o
> +
> +tsm-y := core.o
> +tsm-$(CONFIG_DEVICE_EVIDENCE) += evidence.o
> diff --git a/include/linux/pci-tsm.h b/include/linux/pci-tsm.h
> index a6435aba03f9..8bc16029d31e 100644
> --- a/include/linux/pci-tsm.h
> +++ b/include/linux/pci-tsm.h
> @@ -3,7 +3,10 @@
>   #define __PCI_TSM_H
>   #include <linux/mutex.h>
>   #include <linux/pci.h>
> +#include <linux/rwsem.h>

then this file is missing extern struct rw_semaphore pci_tsm_rwsem;

>   #include <linux/sockptr.h>
> +#include <linux/tsm.h>
> +#include <linux/device/evidence.h>
>   
>   struct pci_tsm;
>   struct tsm_dev;
> @@ -18,6 +21,7 @@ enum pci_tsm_req_scope;
>    * @devsec_ops: Lock, unlock, and interrogate the security state of the
>    *		function via the platform TSM (typically virtual function
>    *		operations).
> + * @refresh_evidence: Common operation to regenerate attestation objects
>    *
>    * This operations are mutually exclusive either a tsm_dev instance
>    * manages physical link properties or it manages function security
> @@ -75,6 +79,9 @@ struct pci_tsm_ops {
>   					struct pci_dev *pdev);
>   		void (*unlock)(struct pci_tsm *tsm);
>   	);
> +
> +	int (*refresh_evidence)(struct pci_tsm *tsm, const void *nonce,
> +				size_t nonce_len);
>   };
>   
>   /**
> @@ -96,6 +103,8 @@ struct pci_tdi {
>    * @tsm_dev: PCI TEE Security Manager device for Link Confidentiality or Device
>    *	     Function Security operations
>    * @tdi: TDI context established by the @bind link operation
> + * @evidence: cached evidence from SPDM session establishment (connect), or
> + *	      TDISP bind (lock)
>    *
>    * This structure is wrapped by low level TSM driver data and returned by
>    * probe()/lock(), it is freed by the corresponding remove()/unlock().
> @@ -112,6 +121,7 @@ struct pci_tsm {
>   	struct pci_dev *dsm_dev;
>   	struct tsm_dev *tsm_dev;
>   	struct pci_tdi *tdi;
> +	struct device_evidence *evidence;
>   };
>   
>   /**
> @@ -216,6 +226,10 @@ void pci_tsm_tdi_constructor(struct pci_dev *pdev, struct pci_tdi *tdi,
>   ssize_t pci_tsm_guest_req(struct pci_dev *pdev, enum pci_tsm_req_scope scope,
>   			  sockptr_t req_in, size_t in_len, sockptr_t req_out,
>   			  size_t out_len, u64 *tsm_code);
> +static inline const struct pci_tsm_ops *to_pci_tsm_ops(struct pci_tsm *tsm)
> +{
> +	return tsm->tsm_dev->pci_ops;
> +}
>   #else
>   static inline int pci_tsm_register(struct tsm_dev *tsm_dev)
>   {
> diff --git a/drivers/pci/tsm.c b/drivers/pci/tsm/core.c
> similarity index 99%
> rename from drivers/pci/tsm.c
> rename to drivers/pci/tsm/core.c

This move + related makefile changes + exposing pci_tsm_rwsem are better be in a separate patch. Thanks,

> index 5fdcd7f2e820..220842df42bc 100644
> --- a/drivers/pci/tsm.c
> +++ b/drivers/pci/tsm/core.c
> @@ -15,13 +15,13 @@
>   #include <linux/sysfs.h>
>   #include <linux/tsm.h>
>   #include <linux/xarray.h>
> -#include "pci.h"
> +#include "../pci.h"
>   
>   /*
>    * Provide a read/write lock against the init / exit of pdev tsm
>    * capabilities and arrival/departure of a TSM instance
>    */
> -static DECLARE_RWSEM(pci_tsm_rwsem);
> +DECLARE_RWSEM(pci_tsm_rwsem);
>   
>   /*
>    * Count of TSMs registered that support physical link operations vs device
> @@ -30,11 +30,6 @@ static DECLARE_RWSEM(pci_tsm_rwsem);
>   static int pci_tsm_link_count;
>   static int pci_tsm_devsec_count;
>   
> -static const struct pci_tsm_ops *to_pci_tsm_ops(struct pci_tsm *tsm)
> -{
> -	return tsm->tsm_dev->pci_ops;
> -}
> -
>   static inline bool is_dsm(struct pci_dev *pdev)
>   {
>   	return pdev->tsm && pdev->tsm->dsm_dev == pdev;
> diff --git a/drivers/pci/tsm/evidence.c b/drivers/pci/tsm/evidence.c
> new file mode 100644
> index 000000000000..ffb08208f0c0
> --- /dev/null
> +++ b/drivers/pci/tsm/evidence.c
> @@ -0,0 +1,110 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +/* Copyright (C) 2026 NVIDIA Corporation & Affiliates */
> +
> +#include <linux/device/evidence.h>
> +#include <linux/init.h>
> +#include <linux/mutex.h>
> +#include <linux/pci.h>
> +#include <linux/pci-tsm.h>
> +#include <linux/tsm.h>
> +
> +extern struct rw_semaphore pci_tsm_rwsem;
> +
> +static bool evidence_available(struct pci_dev *pdev)
> +{
> +	return pdev->tsm && pdev->tsm->evidence;
> +}
> +
> +static struct device *pci_tsm_evidence_find_device(const char *name)
> +{
> +	ACQUIRE(rwsem_read_intr, lock)(&pci_tsm_rwsem);
> +	if (ACQUIRE_ERR(rwsem_read_intr, &lock))
> +		return NULL;
> +
> +	struct device *dev __free(put_device) =
> +		bus_find_device_by_name(&pci_bus_type, NULL, name);
> +
> +	/*
> +	 * Bail evidence gathering early if we know at this point that
> +	 * the device has no valid evidence provider, but still need to
> +	 * revalidate the same in pci_tsm_evidence_read_begin().
> +	 */
> +	if (!dev || !evidence_available(to_pci_dev(dev)))
> +		return NULL;
> +
> +	return no_free_ptr(dev);
> +}
> +
> +static struct device_evidence *pci_tsm_evidence_read_begin(struct device *dev)
> +{
> +	struct pci_dev *pdev = to_pci_dev(dev);
> +	struct device_evidence *evidence;
> +	int rc;
> +
> +	rc = down_read_interruptible(&pci_tsm_rwsem);
> +	if (rc)
> +		return ERR_PTR(rc);
> +
> +	if (!evidence_available(pdev))
> +		goto err;
> +
> +	/* Hold the evidence stable against conflicting refresh updates */
> +	evidence = pdev->tsm->evidence;
> +	rc = down_read_interruptible(&evidence->lock);
> +	if (rc)
> +		goto err;
> +
> +	return evidence;
> +err:
> +	up_read(&pci_tsm_rwsem);
> +	return ERR_PTR(-ENXIO);
> +}
> +
> +static void pci_tsm_evidence_read_end(struct device_evidence *evidence)
> +{
> +	up_read(&evidence->lock);
> +	up_read(&pci_tsm_rwsem);
> +}
> +
> +static int pci_tsm_refresh_evidence(struct device *dev, const void *nonce,
> +				    size_t nonce_len)
> +{
> +	struct pci_dev *pdev = to_pci_dev(dev);
> +	struct device_evidence *evidence;
> +	const struct pci_tsm_ops *ops;
> +	int rc;
> +
> +	/* Sync against disconnect */
> +	ACQUIRE(rwsem_read_intr, lock)(&pci_tsm_rwsem);
> +	if ((rc = ACQUIRE_ERR(rwsem_read_intr, &lock)))
> +		return rc;
> +
> +	if (!pdev->tsm)
> +		return -ENXIO;
> +
> +	ops = to_pci_tsm_ops(pdev->tsm);
> +	if (!ops->refresh_evidence)
> +		return -EOPNOTSUPP;
> +
> +	/* Sync against pci_tsm_evidence_read_begin */
> +	evidence = pdev->tsm->evidence;
> +	ACQUIRE(rwsem_write_kill, elock)(&evidence->lock);
> +	if ((rc = ACQUIRE_ERR(rwsem_write_kill, &elock)))
> +		return rc;
> +
> +	return ops->refresh_evidence(pdev->tsm, nonce, nonce_len);
> +}
> +
> +static const struct device_evidence_ops pci_tsm_evidence_ops = {
> +	.subsys_name = "pci",
> +	.find_device = pci_tsm_evidence_find_device,
> +	.evidence_read_begin = pci_tsm_evidence_read_begin,
> +	.evidence_read_end = pci_tsm_evidence_read_end,
> +	.refresh_evidence = pci_tsm_refresh_evidence,
> +};
> +
> +static int __init pci_tsm_evidence_init(void)
> +{
> +	return device_evidence_register(&pci_tsm_evidence_ops);
> +}
> +subsys_initcall(pci_tsm_evidence_init);
> diff --git a/MAINTAINERS b/MAINTAINERS
> index cb4f74957f69..6cefaddc1120 100644
> --- a/MAINTAINERS
> +++ b/MAINTAINERS
> @@ -27472,7 +27472,7 @@ F:	Documentation/driver-api/coco/
>   F:	Documentation/driver-api/pci/tsm.rst
>   F:	Documentation/netlink/specs/device-evidence.yaml
>   F:	drivers/base/*evidence*
> -F:	drivers/pci/tsm.c
> +F:	drivers/pci/tsm/
>   F:	drivers/virt/coco/guest/
>   F:	include/uapi/linux/device-evidence.h
>   F:	include/linux/device/evidence.h

-- 
Alexey