Re: [PATCH 12/12] PCI/CMA: Grant guests exclusive control of authentication

[Jonathan Cameron <Jonathan.Cameron@Huawei.com>]

On Tue, 3 Oct 2023 21:30:58 +0200
Lukas Wunner <lukas@wunner.de> wrote:

> On Tue, Oct 03, 2023 at 04:40:48PM +0100, Jonathan Cameron wrote:
> > On Thu, 28 Sep 2023 19:32:42 +0200 Lukas Wunner <lukas@wunner.de> wrote:  
> > > At any given time, only a single entity in a physical system may have
> > > an SPDM connection to a device.  That's because the GET_VERSION request
> > > (which begins an authentication sequence) resets "the connection and all
> > > context associated with that connection" (SPDM 1.3.0 margin no 158).
> > > 
> > > Thus, when a device is passed through to a guest and the guest has
> > > authenticated it, a subsequent authentication by the host would reset
> > > the device's CMA-SPDM session behind the guest's back.
> > > 
> > > Prevent by letting the guest claim exclusive CMA ownership of the device
> > > during passthrough.  Refuse CMA reauthentication on the host as long.
> > > After passthrough has concluded, reauthenticate the device on the host.  
> > 
> > Is there anything stopping a PF presenting multiple CMA capable DOE
> > instances?  I'd expect them to have their own contexts if they do..  
> 
> The spec does not seem to *explicitly* forbid a PF having multiple
> CMA-capable DOE instances, but PCIe r6.1 sec 6.31.3 says:
> "The instance of DOE used for CMA-SPDM must support ..."
> 
> Note the singular ("The instance").  It seems to suggest that the
> spec authors assumed there's only a single DOE instance for CMA-SPDM.

It's a little messy and a bit of American vs British English I think.
If it said
"The instance of DOE used for a specific CMA-SPDM must support..." 
then it would clearly allow multiple instances.  However, conversely,
I don't read that sentence as blocking multiple instances (even though
I suspect you are right and the author was thinking of there being one).

> 
> Could you (as an English native speaker) comment on the clarity of the
> two sentences "Prevent ... as long." above, as Ilpo objected to them?
> 
> The antecedent of "Prevent" is the undesirable behaviour in the preceding
> sentence (host resets guest's SPDM connection).
> 
> The antecedent of "as long" is "during passthrough" in the preceding
> sentence.
> 
> Is that clear and understandable for an English native speaker or
> should I rephrase?

Not clear enough to me as it stands.  That "as long" definitely feels
like there is more to follow it as Ilpo noted.

Maybe reword as something like 

Prevent this by letting the guest claim exclusive ownership of the device
during passthrough ensuring problematic CMA reauthentication by the host
is blocked.

Also combine this with previous paragraph to make the 'this' more obvious
refer to the problem described in that paragraph.

Jonathan

> 
> Thanks,
> 
> Lukas
>