linux-pci.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: <dan.j.williams@intel.com>
To: Alexey Kardashevskiy <aik@amd.com>,
	Dan Williams <dan.j.williams@intel.com>,
	<linux-coco@lists.linux.dev>, <linux-pci@vger.kernel.org>
Cc: <yilun.xu@linux.intel.com>, <aneesh.kumar@kernel.org>,
	<gregkh@linuxfoundation.org>, Bjorn Helgaas <bhelgaas@google.com>,
	"Lukas Wunner" <lukas@wunner.de>,
	Samuel Ortiz <sameo@rivosinc.com>
Subject: Re: [PATCH v5 07/10] PCI/IDE: Add IDE establishment helpers
Date: Thu, 4 Sep 2025 18:40:02 -0700	[thread overview]
Message-ID: <68ba3f725b284_75e3100a5@dwillia2-mobl4.notmuch> (raw)
In-Reply-To: <6608a45f-b789-48c9-9418-5d6c2956975f@amd.com>

Alexey Kardashevskiy wrote:
[..]
> >> +/**
> >> + * pci_ide_stream_enable() - enable a Selective IDE Stream
> >> + * @pdev: PCIe device object for either a Root Port or Endpoint Partner Port
> >> + * @ide: registered and setup IDE settings descriptor
> >> + *
> >> + * Activate the stream by writing to the Selective IDE Stream Control
> >> + * Register.
> >> + *
> >> + * Return: 0 if the stream successfully entered the "secure" state, and -ENXIO
> >> + * otherwise.
> >> + *
> >> + * Note that the state may go "insecure" at any point after returning 0, but
> >> + * those events are equivalent to a "link down" event and handled via
> >> + * asynchronous error reporting.
> >> + */
> >> +int pci_ide_stream_enable(struct pci_dev *pdev, struct pci_ide *ide)
> >> +{
> >> +    struct pci_ide_partner *settings = pci_ide_to_settings(pdev, ide);
> >> +    int pos;
> >> +    u32 val;
> >> +
> >> +    if (!settings)
> >> +        return -ENXIO;
> >> +
> >> +    pos = sel_ide_offset(pdev, settings);
> >> +
> >> +    set_ide_sel_ctl(pdev, ide, pos, true);
> >> +
> >> +    pci_read_config_dword(pdev, pos + PCI_IDE_SEL_STS, &val);
> >> +    if (FIELD_GET(PCI_IDE_SEL_STS_STATE, val) !=
> >> +        PCI_IDE_SEL_STS_STATE_SECURE) {
> >> +        set_ide_sel_ctl(pdev, ide, pos, false);
> 
> 
> Ah this is an actual problem, this is not right. The PCIe r6.1 spec says:
> 
> "It is permitted, but strongly not recommended, to Set the Enable bit in the IDE Extended Capability
> entry for a Stream prior to the completion of key programming for that Stream".

This ordering is controlled by the TSM driver though...

> 
> And I have a device like that where the links goes secure after the last
> key is SET_GO. So it is okay to return an error here but not ok to clear
> the Enabled bit.

...can you not simply wait to call pci_ide_stream_enable() until after the
SET_GO?

Are you saying the problem is that the shutdown path needs to do the
reverse SET_STOP before disabling the stream?

> Was it "Do or do not, there is no try for pci_ide_stream_enable() (Bjorn)" in the changelog? Not very descriptive :-/ Thanks,

I understand he was taking issue with the comment, but this practical issue
is much more serious. I will push error detection and cleanup out of this
helper, and make it return void.

Thanks for the hardware testing!

  reply	other threads:[~2025-09-05  1:40 UTC|newest]

Thread overview: 38+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-08-27  3:51 [PATCH v5 00/10] PCI/TSM: Core infrastructure for PCI device security (TDISP) Dan Williams
2025-08-27  3:51 ` [PATCH v5 01/10] coco/tsm: Introduce a core device for TEE Security Managers Dan Williams
2025-08-27  3:51 ` [PATCH v5 02/10] PCI/IDE: Enumerate Selective Stream IDE capabilities Dan Williams
2025-08-27  3:51 ` [PATCH v5 03/10] PCI: Introduce pci_walk_bus_reverse(), for_each_pci_dev_reverse() Dan Williams
2025-08-27  3:51 ` [PATCH v5 04/10] PCI/TSM: Authenticate devices via platform TSM Dan Williams
2025-08-27 13:25   ` Alexey Kardashevskiy
2025-08-29  1:06     ` dan.j.williams
2025-08-29  1:58       ` Alexey Kardashevskiy
2025-09-05  0:50         ` dan.j.williams
2025-09-05  3:34           ` Alexey Kardashevskiy
2025-09-06  2:07             ` dan.j.williams
2025-08-28 11:43   ` Alexey Kardashevskiy
2025-08-29  1:23     ` dan.j.williams
2025-08-30 13:26   ` Alexey Kardashevskiy
2025-09-05  0:51     ` dan.j.williams
2025-09-02 15:08   ` Aneesh Kumar K.V
2025-09-03  2:03     ` Alexey Kardashevskiy
2025-09-05 20:06       ` dan.j.williams
2025-09-05 19:13     ` dan.j.williams
2025-09-02 15:13   ` Aneesh Kumar K.V
2025-09-03  2:07     ` Alexey Kardashevskiy
2025-09-05 20:13       ` dan.j.williams
2025-09-05 20:03     ` dan.j.williams
2025-09-03  2:17   ` Alexey Kardashevskiy
2025-09-05 20:35     ` dan.j.williams
2025-08-27  3:51 ` [PATCH v5 05/10] samples/devsec: Introduce a PCI device-security bus + endpoint sample Dan Williams
2025-08-27  3:51 ` [PATCH v5 06/10] PCI: Add PCIe Device 3 Extended Capability enumeration Dan Williams
2025-08-27  3:51 ` [PATCH v5 07/10] PCI/IDE: Add IDE establishment helpers Dan Williams
2025-09-02  1:29   ` Alexey Kardashevskiy
2025-09-02  1:54     ` Alexey Kardashevskiy
2025-09-05  1:40       ` dan.j.williams [this message]
2025-09-05  2:14         ` Alexey Kardashevskiy
2025-09-06  2:00           ` dan.j.williams
2025-09-05  1:27     ` dan.j.williams
2025-09-05  2:23       ` Alexey Kardashevskiy
2025-08-27  3:51 ` [PATCH v5 08/10] PCI/IDE: Report available IDE streams Dan Williams
2025-08-27  3:51 ` [PATCH v5 09/10] PCI/TSM: Report active " Dan Williams
2025-08-27  3:51 ` [PATCH v5 10/10] samples/devsec: Add sample IDE establishment Dan Williams

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=68ba3f725b284_75e3100a5@dwillia2-mobl4.notmuch \
    --to=dan.j.williams@intel.com \
    --cc=aik@amd.com \
    --cc=aneesh.kumar@kernel.org \
    --cc=bhelgaas@google.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=linux-coco@lists.linux.dev \
    --cc=linux-pci@vger.kernel.org \
    --cc=lukas@wunner.de \
    --cc=sameo@rivosinc.com \
    --cc=yilun.xu@linux.intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).