linux-kernel - Re: [PATCH kernel 1/6] PCI/TSM: Add secure SPDM DOE mailbox

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <69168b145da7f_10154100fd@dwillia2-mobl4.notmuch>
Date: Thu, 13 Nov 2025 17:51:16 -0800
From: <dan.j.williams@...el.com>
To: Alexey Kardashevskiy <aik@....com>, <linux-kernel@...r.kernel.org>
CC: <linux-crypto@...r.kernel.org>, <linux-pci@...r.kernel.org>, Tom Lendacky
	<thomas.lendacky@....com>, John Allen <john.allen@....com>, Herbert Xu
	<herbert@...dor.apana.org.au>, "David S. Miller" <davem@...emloft.net>,
	Ashish Kalra <ashish.kalra@....com>, Joerg Roedel <joro@...tes.org>, "Suravee
 Suthikulpanit" <suravee.suthikulpanit@....com>, Will Deacon
	<will@...nel.org>, Robin Murphy <robin.murphy@....com>, Dan Williams
	<dan.j.williams@...el.com>, Bjorn Helgaas <bhelgaas@...gle.com>, Eric Biggers
	<ebiggers@...gle.com>, Brijesh Singh <brijesh.singh@....com>, Gary R Hook
	<gary.hook@....com>, "Borislav Petkov (AMD)" <bp@...en8.de>, Kim Phillips
	<kim.phillips@....com>, Vasant Hegde <vasant.hegde@....com>, Jason Gunthorpe
	<jgg@...pe.ca>, "Michael Roth" <michael.roth@....com>, Jonathan Cameron
	<jonathan.cameron@...wei.com>, Xu Yilun <yilun.xu@...ux.intel.com>, Gao
 Shiyuan <gaoshiyuan@...du.com>, "Sean Christopherson" <seanjc@...gle.com>,
	Nikunj A Dadhania <nikunj@....com>, Dionna Glaze <dionnaglaze@...gle.com>,
	<iommu@...ts.linux.dev>, <linux-coco@...ts.linux.dev>, Alexey Kardashevskiy
	<aik@....com>
Subject: Re: [PATCH kernel 1/6] PCI/TSM: Add secure SPDM DOE mailbox

Alexey Kardashevskiy wrote:
> The IDE key programming happens via Secure SPDM channel, initialise it
> at the PF0 probing.
> 
> Add the SPDM certificate slot (up to 8 are allowed by SPDM), the platform
> is expected to select one.
> 
> While at this, add a common struct for SPDM request/response as these
> are going to needed by every platform.
> 
> Signed-off-by: Alexey Kardashevskiy <aik@....com>
> ---
> 
> (!tsm->doe_mb_sec) is definitely an error on AMD SEV-TIO, is not it on other platforms?

I think you just happen to have a multi-DOE test device, or a device
that has a PCI_DOE_FEATURE_SSESSION DOE and not a PCI_DOE_FEATURE_CMA
DOE.

> ---
>  include/linux/pci-tsm.h | 14 ++++++++++++++
>  drivers/pci/tsm.c       |  4 ++++
>  2 files changed, 18 insertions(+)
> 
> diff --git a/include/linux/pci-tsm.h b/include/linux/pci-tsm.h
> index 40c5e4c31a3f..b6866f7c14b4 100644
> --- a/include/linux/pci-tsm.h
> +++ b/include/linux/pci-tsm.h
> @@ -10,6 +10,14 @@ struct tsm_dev;
>  struct kvm;
>  enum pci_tsm_req_scope;
>  
> +/* SPDM control structure for DOE */
> +struct tsm_spdm {
> +	unsigned long req_len;
> +	void *req;
> +	unsigned long rsp_len;
> +	void *rsp;
> +};

I would only add things to the core that the core needs, or all
implementations can unify. You can see that tdx_spdm_msg_exchange() can
not use this common definition for example.

> +
>  /*
>   * struct pci_tsm_ops - manage confidential links and security state
>   * @link_ops: Coordinate PCIe SPDM and IDE establishment via a platform TSM.
> @@ -130,11 +138,17 @@ struct pci_tsm {
>   * @base_tsm: generic core "tsm" context
>   * @lock: mutual exclustion for pci_tsm_ops invocation
>   * @doe_mb: PCIe Data Object Exchange mailbox
> + * @doe_mb_sec: DOE mailbox used when secured SPDM is requested
> + * @spdm: cached SPDM request/response buffers for the link
> + * @cert_slot: SPDM certificate slot
>   */
>  struct pci_tsm_pf0 {
>  	struct pci_tsm base_tsm;
>  	struct mutex lock;
>  	struct pci_doe_mb *doe_mb;
> +	struct pci_doe_mb *doe_mb_sec;

See below, pci_tsm_pf0 should only ever need one doe_mb instance.

> +	struct tsm_spdm spdm;

Per above, just move @tsm_spdm into the TIO object that wraps
pci_tsm_pf0.

> +	u8 cert_slot;
>  };
>  
>  struct pci_tsm_mmio {
> diff --git a/drivers/pci/tsm.c b/drivers/pci/tsm.c
> index ed8a280a2cf4..378748b15825 100644
> --- a/drivers/pci/tsm.c
> +++ b/drivers/pci/tsm.c
> @@ -1067,6 +1067,10 @@ int pci_tsm_pf0_constructor(struct pci_dev *pdev, struct pci_tsm_pf0 *tsm,
>  		pci_warn(pdev, "TSM init failure, no CMA mailbox\n");
>  		return -ENODEV;
>  	}
> +	tsm->doe_mb_sec = pci_find_doe_mailbox(pdev, PCI_VENDOR_ID_PCI_SIG,
> +					       PCI_DOE_FEATURE_SSESSION);
> +	if (!tsm->doe_mb_sec)
> +		pci_warn(pdev, "TSM init failed to init SSESSION mailbox\n");

So it is surprising to find that a device supports PCI_DOE_FEATURE_CMA,
but requires the TSM to also use the PCI_DOE_FEATURE_SSESSION mailbox?
A PCI_DOE_FEATURE_CMA mailbox is capable of supporting secure sessions
and IDE.

When a device supports multiple DOE, the VMM does need to pick one, but the
hope was that "first CMA DOE" would work, but apparently you have a
device that wants to violate this simple heuristic?

What happens on this device if you use the CMA mailbox for IDE
establishment and secure sessions?