PCI device authentication & encryption
summary
Two kernel patch sets converge on a concrete plan: one brings SPDM artifacts via CISFS plus a netlink delivery path for signatures, the other implements the PCI/TSM state machine and is merged for 6.19, so work can build on it now. Proposal keeps device probing controllable, uses kernel keyrings or the existing mock preload for certificates, and funnels measurements over netlink notifications for measurements. Authentication is performed after lock before accept so user space can verify evidence and then allow driver probe.
AI-written summary · about
chapters (8)
- 0:00Introduction to PCI device authentication
- 2:06Current patch sets overview
- 6:03CMA and trusted VM contexts
- 12:28Certificate installation challenges
- 17:00Authentication and probing policy
- 21:15CISFS vs Netlink interfaces
- 23:23Integration challenges and next steps
- 26:43Q&A and closing remarks
related talks
01h 00mPCI device authentication encryption
31mSecure IO
13mMaking PCI devices ready for confidential computing
42mProtecting the Linux Kernel from Confidential Computing Threats in Virtual Environments
30mDevice Attestation in Hardware TEE based Confidential Computing
23mTPM
45mTPMs & The Linux Kernel: Unlocking A Better Path To Hardware Security
47mTPMs and the Linux Kernel: unlocking a better path to hardware security