Linux driver core gains proposed device trust levels for confidential computing

Leon Romanovsky has posted a driver-core series that turns PCI's longstanding untrusted flag into a general device trust model every bus can use, with userspace holding the final say before a driver attaches.

Three levels are defined. DISABLED keeps the device quarantined and unbound so the kernel does not operate it at all; confidential-computing boots are expected to start every device in this state. ADVERSARY treats the hardware as potentially hostile and asks the bus and DMA layers for whatever defenses they can enforce, such as a strict IOMMU and avoiding exposure of unrelated memory. FULL is ordinary operation.

The point is policy injection, not a new kernel threat taxonomy. Confidential-computing systems need to authenticate a device, enable link encryption, and run other checks in userspace before any DMA is allowed. With a default of DISABLED, only a handful of early platform pieces (interrupt controllers, timers, IOMMUs) come up; an initrd agent can then raise trust and trigger a normal bind. Romanovsky notes that any autoprobe of real hardware before that policy step would itself be an attack surface.

Sysfs exposes a requested trust policy and a read-only active level. Once the level is committed it stays fixed for the device object's life, including failed probes, unbind, and reset. PCI's existing untrusted semantics map onto ADVERSARY. The same DISABLED/FULL gate is intended to work out of the box on other buses, including USB, whose separate authorized attribute already delays binding and could later share the common flag.

Reviewers pressed on scope. Andrew Lunn questioned how far bus drivers may go with clocks, regulators, GPIOs, and PHYs before enumeration, and flagged fragile PHY attach paths. Jason Gunthorpe and Robin Murphy argued the kernel should not enumerate every subsystem threat model: bus drivers contain children as best they can, userspace accepts that containment when it raises trust, and "impactful" device-initiated behavior (wired IRQs, MSI writes) is what matters, not ordinary consumed resources. Greg Kroah-Hartman asked whether USB authentication would follow the same path; working devices for that USB spec remain scarce. Alan Stern and Dmitry Torokhov raised locking and claim-ordering issues in USB and serio that still need tightening so admission cannot race functional setup.

If merged, the change gives confidential-computing and other locked-down boots a single place to withhold driver control until external policy is satisfied, without inventing per-bus one-offs.