Re: [PATCH v2 18/19] PCI: Replace untrusted state with device trust

[Robin Murphy]

On 09/11/2026 7:33 am, Leon Romanovsky wrote:
[...]
> diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
> index b486b8bbd1fcd..8be2a246d4903 100644
> --- a/drivers/iommu/iommu.c
> +++ b/drivers/iommu/iommu.c
> @@ -1879,7 +1879,7 @@ static int iommu_get_def_domain_type(struct iommu_group *group,
>   static int iommu_get_default_domain_type(struct iommu_group *group,
>   					 int target_type)
>   {
> -	struct device *untrusted = NULL;
> +	struct device *restricted = NULL;
>   	struct group_device *gdev;
>   	int driver_type = 0;
>   
> @@ -1901,14 +1901,15 @@ static int iommu_get_default_domain_type(struct iommu_group *group,
>   		driver_type = iommu_get_def_domain_type(group, gdev->dev,
>   							driver_type);
>   
> -		if (dev_is_pci(gdev->dev) && to_pci_dev(gdev->dev)->untrusted) {
> +		if (dev_is_pci(gdev->dev) &&
> +		    pci_dev_default_is_restricted(to_pci_dev(gdev->dev))) {

I think this should be the generic device_is_adversarial(gdev->dev) now 
- in fact probably all the dev_is_pci()/to_pci_dev() stanzas aren't 
conceptually PCI-specific, just an artefact of the current "untrusted" 
flag being so.

>   			/*
> -			 * No ARM32 using systems will set untrusted, it cannot
> -			 * work.
> +			 * No ARM32 using systems select a restricted trust
> +			 * policy; it cannot work.
>   			 */
>   			if (WARN_ON(IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU)))
>   				return -1;
> -			untrusted = gdev->dev;
> +			restricted = gdev->dev;
>   		}
>   	}
>   
[...]
> @@ -616,6 +608,28 @@ static inline struct pci_dev *to_pci_dev(const struct device *dev)
>   {
>   	return container_of(dev, struct pci_dev, dev);
>   }
> +
> +static inline bool
> +pci_dev_default_is_restricted(const struct pci_dev *pdev)
> +{
> +	enum device_trust_policy policy = READ_ONCE(pdev->dev.trust_policy);
> +
> +	return policy == DEVICE_TRUST_POLICY_DISABLED ||
> +	       policy == DEVICE_TRUST_POLICY_ADVERSARY;
> +}

Unless I've wildly misunderstood, I'm not sure this is right - if the 
user has set DEVICE_TRUST_POLICY_DISABLED to explicitly override the 
bus-default behaviour, but that leads to the IOMMU layer special-casing 
all PCI devices as adversarial and thus force-*enabling* all their 
trust-model restrictions, isn't that pretty much the complete opposite 
of what was asked for?

Thanks,
Robin.

> +
> +static inline bool pci_dev_ats_permitted(const struct pci_dev *pdev)
> +{
> +	enum device_trust_level level = device_get_trust_level(&pdev->dev);
> +	enum device_trust_policy policy = READ_ONCE(pdev->dev.trust_policy);
> +
> +	if (level == DEVICE_TRUST_DISABLED)
> +		return policy != DEVICE_TRUST_POLICY_ADVERSARY &&
> +		       policy != DEVICE_TRUST_POLICY_DISABLED;
> +
> +	return level == DEVICE_TRUST_FULL;
> +}
> +
>   #define for_each_pci_dev(d) while ((d = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, d)) != NULL)
>   #define for_each_pci_dev_reverse(d) \
>   	while ((d = pci_get_device_reverse(PCI_ANY_ID, PCI_ANY_ID, d)) != NULL)