Re: [PATCH v2 18/19] PCI: Replace untrusted state with device trust

[Leon Romanovsky <leon@kernel.org>]

On Mon, Nov 09, 2026 at 01:53:02PM +0000, Robin Murphy wrote:
> On 09/11/2026 7:33 am, Leon Romanovsky wrote:
> [...]
> > diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
> > index b486b8bbd1fcd..8be2a246d4903 100644
> > --- a/drivers/iommu/iommu.c
> > +++ b/drivers/iommu/iommu.c
> > @@ -1879,7 +1879,7 @@ static int iommu_get_def_domain_type(struct iommu_group *group,
> >   static int iommu_get_default_domain_type(struct iommu_group *group,
> >   					 int target_type)
> >   {
> > -	struct device *untrusted = NULL;
> > +	struct device *restricted = NULL;
> >   	struct group_device *gdev;
> >   	int driver_type = 0;
> > @@ -1901,14 +1901,15 @@ static int iommu_get_default_domain_type(struct iommu_group *group,
> >   		driver_type = iommu_get_def_domain_type(group, gdev->dev,
> >   							driver_type);
> > -		if (dev_is_pci(gdev->dev) && to_pci_dev(gdev->dev)->untrusted) {
> > +		if (dev_is_pci(gdev->dev) &&
> > +		    pci_dev_default_is_restricted(to_pci_dev(gdev->dev))) {
> 
> I think this should be the generic device_is_adversarial(gdev->dev) now - in
> fact probably all the dev_is_pci()/to_pci_dev() stanzas aren't conceptually
> PCI-specific, just an artefact of the current "untrusted" flag being so.

I wanted to do the same, but iommu_get_default_domain_type() may be called
before the PCI device's trust level has been set. At that point, we are
still in "disabled" mode, whereas device_is_adversarial() checks for
"adversarial" mode.

The below is from AI, I asked to present me the path for that:
--------------------------------------------------------------------------------
For a newly discovered PCI device with an available IOMMU and a new IOMMU group:
pci_scan_single_device()
  pci_device_add()
    device_add()
      bus_notify(dev, BUS_NOTIFY_ADD_DEVICE)
        blocking_notifier_call_chain()
          notifier_call_chain()
            iommu_bus_notifier()
              iommu_probe_device(dev)
                __iommu_probe_device(dev, NULL)
                  iommu_setup_default_domain(group, 0)
                    iommu_get_default_domain_type(group, 0)

For a device whose initial policy is adversary, its state during that call is:
dev->trust_policy          = DEVICE_TRUST_POLICY_ADVERSARY
dev->trust_level           = DEVICE_TRUST_DISABLED
dev->trust_committed_level = DEVICE_TRUST_DISABLED
dev->driver               = NULL

device_is_adversarial(dev) = false

The active level changes later, during binding:
really_probe()
  device_trust_prepare()
    __device_trust_prepare()
      WRITE_ONCE(dev->trust_level, DEVICE_TRUST_ADVERSARY)
  dev->bus->dma_configure()
  call_driver_probe()

> 
> >   			/*
> > -			 * No ARM32 using systems will set untrusted, it cannot
> > -			 * work.
> > +			 * No ARM32 using systems select a restricted trust
> > +			 * policy; it cannot work.
> >   			 */
> >   			if (WARN_ON(IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU)))
> >   				return -1;
> > -			untrusted = gdev->dev;
> > +			restricted = gdev->dev;
> >   		}
> >   	}
> [...]
> > @@ -616,6 +608,28 @@ static inline struct pci_dev *to_pci_dev(const struct device *dev)
> >   {
> >   	return container_of(dev, struct pci_dev, dev);
> >   }
> > +
> > +static inline bool
> > +pci_dev_default_is_restricted(const struct pci_dev *pdev)
> > +{
> > +	enum device_trust_policy policy = READ_ONCE(pdev->dev.trust_policy);
> > +
> > +	return policy == DEVICE_TRUST_POLICY_DISABLED ||
> > +	       policy == DEVICE_TRUST_POLICY_ADVERSARY;
> > +}
> 
> Unless I've wildly misunderstood, I'm not sure this is right - if the user
> has set DEVICE_TRUST_POLICY_DISABLED to explicitly override the bus-default
> behaviour, but that leads to the IOMMU layer special-casing all PCI devices
> as adversarial and thus force-*enabling* all their trust-model restrictions,
> isn't that pretty much the complete opposite of what was asked for?

We have two levels: policy - that describes the default of all devices
for that bus. level - actual decision on how that device is going to be
operated.

"Disabled" prevents driver probing until the device is authorized,
"Adversary" permits probing and requests the available protections
for operating an untrusted device.

Both need conservative initial IOMMU setup: a disabled device may later
be authorized as adversary, and authorization does not rebuild its IOMMU
domain.

Thanks

> 
> Thanks,
> Robin.
> 
> > +
> > +static inline bool pci_dev_ats_permitted(const struct pci_dev *pdev)
> > +{
> > +	enum device_trust_level level = device_get_trust_level(&pdev->dev);
> > +	enum device_trust_policy policy = READ_ONCE(pdev->dev.trust_policy);
> > +
> > +	if (level == DEVICE_TRUST_DISABLED)
> > +		return policy != DEVICE_TRUST_POLICY_ADVERSARY &&
> > +		       policy != DEVICE_TRUST_POLICY_DISABLED;
> > +
> > +	return level == DEVICE_TRUST_FULL;
> > +}
> > +
> >   #define for_each_pci_dev(d) while ((d = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, d)) != NULL)
> >   #define for_each_pci_dev_reverse(d) \
> >   	while ((d = pci_get_device_reverse(PCI_ANY_ID, PCI_ANY_ID, d)) != NULL)
> > 
>