lib: Rust implementation of SPDM

From: Alistair Francis <[email protected]>

Make the functions crypto_shash_descsize(), crypto_shash_digestsize() and crypto_free_shash() available to Rust.

Signed-off-by Alistair Francis <[email protected]>

---
 rust/bindings/bindings_helper.h |  2 ++
 rust/helpers/hash.c             | 18 ++++++++++++++++++
 rust/helpers/helpers.c          |  1 +
 3 files changed, 21 insertions(+)
 create mode 100644 rust/helpers/hash.c

rust/bindings/bindings_helper.h +2 -0

index a067038b4b42..0075c4b62c29 100644
@@ -34,6 +34,7 @@
 #include <drm/drm_file.h>
 #include <drm/drm_gem.h>
 #include <drm/drm_ioctl.h>
+#include <crypto/hash.h>
 #include <kunit/test.h>
 #include <linux/auxiliary_bus.h>
 #include <linux/bitmap.h>

@@ -60,6 +61,7 @@
 #include <linux/fs.h>
 #include <linux/i2c.h>
 #include <linux/ioport.h>
+#include <linux/hash.h>
 #include <linux/jiffies.h>
 #include <linux/jump_label.h>
 #include <linux/mdio.h>

rust/helpers/hash.c new file +5 -0

new file mode 100644
index 000000000000..8ddb84668841
@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <crypto/hash.h>
+
+unsigned int rust_helper_crypto_shash_descsize(struct crypto_shash 

*tfm)

rust/helpers/hash.c new file +5 -0

+{
+	return crypto_shash_descsize(tfm);
+}
+
+unsigned int rust_helper_crypto_shash_digestsize(struct crypto_shash 

*tfm)

rust/helpers/hash.c new file +8 -0

+{
+	return crypto_shash_digestsize(tfm);
+}
+
+void rust_helper_crypto_free_shash(struct crypto_shash *tfm)
+{
+	crypto_free_shash(tfm);
+}

rust/helpers/helpers.c +1 -0

index a3c42e51f00a..4b08b4f1d3a3 100644
@@ -30,6 +30,7 @@
 #include "dma.c"
 #include "drm.c"
 #include "err.c"
+#include "hash.c"
 #include "irq.c"
 #include "fs.c"
 #include "io.c"

From: Alistair Francis <[email protected]>

Make the functions crypto_shash_descsize(), crypto_shash_digestsize() and crypto_free_shash() available to Rust.

Signed-off-by Alistair Francis <[email protected]>

---
 rust/bindings/bindings_helper.h |  2 ++
 rust/helpers/hash.c             | 18 ++++++++++++++++++
 rust/helpers/helpers.c          |  1 +
 3 files changed, 21 insertions(+)
 create mode 100644 rust/helpers/hash.c

rust/bindings/bindings_helper.h +0 -0

index a067038b4b42..0075c4b62c29 100644

rust/bindings/bindings_helper.h +0 -0

 #include <kunit/test.h>
 #include <linux/auxiliary_bus.h>
 #include <linux/bitmap.h>

@@ -60,6 +61,7 @@

From: Alistair Francis <[email protected]>

Implement From<FromBytesWithNulError> for the Kernel Error type

Signed-off-by Alistair Francis <[email protected]>

---
 rust/kernel/error.rs | 7 +++++++
 1 file changed, 7 insertions(+)

rust/kernel/error.rs +1 -0

index 258b12afdcba..569d9d032ab3 100644
@@ -12,6 +12,7 @@
     str::CStr,
 };
 
+use core::ffi::FromBytesWithNulError;
 use core::num::NonZeroI32;
 use core::num::TryFromIntError;
 use core::str::Utf8Error;

rust/kernel/error.rs +1 -0

+
 /// A [`Result`] with an [`Error`] error type.
 ///
 /// To be used as the return type for functions that may fail.

Quoted 25 lines · On 2026-02-11 03:29, [email protected] wrote:

From: Alistair Francis <[email protected]>

Implement From<FromBytesWithNulError> for the Kernel Error type

Signed-off-by Alistair Francis <[email protected]>

---
 rust/kernel/error.rs | 7 +++++++
 1 file changed, 7 insertions(+)

rust/kernel/error.rs +1 -0

index 258b12afdcba..569d9d032ab3 100644
@@ -12,6 +12,7 @@
     str::CStr,
 };
 
+use core::ffi::FromBytesWithNulError;
 use core::num::NonZeroI32;
 use core::num::TryFromIntError;
 use core::str::Utf8Error;

@@ -251,6 +252,12 @@ fn from(e: core::convert::Infallible) -> Error {
     }
 }
 

rust/kernel/error.rs fn from(e: core::convert::Infallible) -> Error { · line 259

Quoted 5 lines

rust/kernel/error.rs +5 -0

+impl From<FromBytesWithNulError> for Error {
+    fn from(_: FromBytesWithNulError) -> Error {
+        code::EINVAL
+    }
+}

Are we sure that FromBytesWithNulError maps cleanly to the EINVAL error code?

Anyhow, please add #[inline] for such simple functions.

Best,
Gary

Quoted 4 lines

rust/kernel/error.rs +1 -0

+
 /// A [`Result`] with an [`Error`] error type.
 ///
 /// To be used as the return type for functions that may fail.

Quoted 27 lines · Gary Guo

Quoted 25 lines · On 2026-02-11 03:29, [email protected] wrote:

From: Alistair Francis <[email protected]>

Implement From<FromBytesWithNulError> for the Kernel Error type

Signed-off-by Alistair Francis <[email protected]>

---
 rust/kernel/error.rs | 7 +++++++
 1 file changed, 7 insertions(+)

rust/kernel/error.rs +1 -0

index 258b12afdcba..569d9d032ab3 100644
@@ -12,6 +12,7 @@
     str::CStr,
 };
 
+use core::ffi::FromBytesWithNulError;
 use core::num::NonZeroI32;
 use core::num::TryFromIntError;
 use core::str::Utf8Error;

@@ -251,6 +252,12 @@ fn from(e: core::convert::Infallible) -> Error {
     }
 }
 

Quoted 8 lines

rust/kernel/error.rs fn from(e: core::convert::Infallible) -> Error { · line 259

Quoted 5 lines

rust/kernel/error.rs +5 -0

+impl From<FromBytesWithNulError> for Error {
+    fn from(_: FromBytesWithNulError) -> Error {
+        code::EINVAL
+    }
+}

Are we sure that FromBytesWithNulError maps cleanly to the EINVAL error code?

FromBytesWithNulError means "An error indicating that a nul byte was not in the expected position." [1]

To me that maps with EINVAL

1: https://doc.rust-lang.org/std/ffi/enum.FromBytesWithNulError.html

Quoted 2 lines

Anyhow, please add #[inline] for such simple functions.

I can, just noting that none of the others have #[inline]

From: Alistair Francis <[email protected]>

This is the initial commit of the Rust SPDM library. It is based on and compatible with the C SPDM library in the kernel (lib/spdm).

Signed-off-by Alistair Francis <[email protected]>

---
 MAINTAINERS                     |  12 ++
 include/linux/spdm.h            |  39 ++++++
 lib/Kconfig                     |  17 +++
 lib/Makefile                    |   2 +
 lib/rspdm/Makefile              |  10 ++
 lib/rspdm/consts.rs             | 117 +++++++++++++++++
 lib/rspdm/lib.rs                | 119 +++++++++++++++++
 lib/rspdm/state.rs              | 220 ++++++++++++++++++++++++++++++++
 lib/rspdm/validator.rs          |  66 ++++++++++
 rust/bindings/bindings_helper.h |   2 +
 rust/kernel/error.rs            |   3 +
 11 files changed, 607 insertions(+)
 create mode 100644 include/linux/spdm.h
 create mode 100644 lib/rspdm/Makefile
 create mode 100644 lib/rspdm/consts.rs
 create mode 100644 lib/rspdm/lib.rs
 create mode 100644 lib/rspdm/state.rs
 create mode 100644 lib/rspdm/validator.rs

MAINTAINERS +0 -0

index 149deedafe2c..a5c4ec16081c 100644

MAINTAINERS +9 -0

+M:	Lukas Wunner <[email protected]>
+M:	Alistair Francis <[email protected]>
+L:	[email protected]
+L:	[email protected]
+L:	[email protected]
+S:	Maintained
+T:	git git://git.kernel.org/pub/scm/linux/kernel/git/devsec/spdm.git
+F:	include/linux/spdm.h
+F:	lib/rspdm/
 
 

lib/rspdm/consts.rs new file +7 -0

new file mode 100644
index 000000000000..40ce60eba2f3
@@ -0,0 +1,117 @@
+// SPDX-License-Identifier: GPL-2.0
+
+// Copyright (C) 2024 Western Digital
+
+//! Constants used by the library
+//!
+//! Rust implementation of the DMTF Security Protocol and Data Model (SPDM)

lib/rspdm/consts.rs new file +19 -0

+    Busy = 0x03,
+    UnexpectedRequest = 0x04,
+    Unspecified = 0x05,
+    DecryptError = 0x06,
+    UnsupportedRequest = 0x07,
+    RequestInFlight = 0x08,
+    InvalidResponseCode = 0x09,
+    SessionLimitExceeded = 0x0a,
+    SessionRequired = 0x0b,
+    ResetRequired = 0x0c,
+    ResponseTooLarge = 0x0d,
+    RequestTooLarge = 0x0e,
+    LargeResponse = 0x0f,
+    MessageLost = 0x10,
+    InvalidPolicy = 0x11,
+    VersionMismatch = 0x41,
+    ResponseNotReady = 0x42,
+    RequestResynch = 0x43,
+    OperationFailed = 0x44,

lib/rspdm/consts.rs new file +5 -0

+            }
 
+        }
+        Ok(())
+    }
+}

lib/rspdm/lib.rs new file +3 -0

new file mode 100644
index 000000000000..2bb716140e0a
@@ -0,0 +1,119 @@
+// SPDX-License-Identifier: GPL-2.0
+
+// Copyright (C) 2024 Western Digital

lib/rspdm/state.rs new file +20 -0

new file mode 100644
index 000000000000..68861f30e3fa
@@ -0,0 +1,220 @@
+// SPDX-License-Identifier: GPL-2.0
+
+// Copyright (C) 2024 Western Digital
+
+//! The `SpdmState` struct and implementation.
+//!
+//! Rust implementation of the DMTF Security Protocol and Data Model (SPDM)
+//! <https://www.dmtf.org/dsp/DSP0274>
+
+use core::ffi::c_void;
+use kernel::prelude::*;
+use kernel::{
+    bindings,
+    error::{code::EINVAL, to_result, Error},
+    validate::Untrusted,
+};
+
+use crate::consts::{SpdmErrorCode, SPDM_ERROR, SPDM_REQ};
+use crate::validator::{SpdmErrorRsp, SpdmHeader};
+

lib/rspdm/state.rs new file +38 -0

+/// `validate`: Function to validate additional leaf certificate requirements.
+///
+/// `version`: Maximum common supported version of requester and responder.
+///  Negotiated during GET_VERSION exchange.
+#[expect(dead_code)]
+pub struct SpdmState {
+    pub(crate) dev: *mut bindings::device,
+    pub(crate) transport: bindings::spdm_transport,
+    pub(crate) transport_priv: *mut c_void,
+    pub(crate) transport_sz: u32,
+    pub(crate) keyring: *mut bindings::key,
+    pub(crate) validate: bindings::spdm_validate,
+
+    // Negotiated state
+    pub(crate) version: u8,
+}
+
+impl SpdmState {
+    pub(crate) fn new(
+        dev: *mut bindings::device,
+        transport: bindings::spdm_transport,
+        transport_priv: *mut c_void,
+        transport_sz: u32,
+        keyring: *mut bindings::key,
+        validate: bindings::spdm_validate,
+    ) -> Self {
+        SpdmState {
+            dev,
+            transport,
+            transport_priv,
+            transport_sz,
+            keyring,
+            validate,
+            version: 0x10,
+        }
+    }
 
+
+    /// Start a SPDM exchange

lib/rspdm/state.rs new file +43 -0

+        let response: &SpdmHeader = Untrusted::new_ref(response_buf).validate()?;
+
+        let transport_function = self.transport.ok_or(EINVAL)?;
+        // SAFETY: `transport_function` is provided by the new(), we are
+        // calling the function.
+        let length = unsafe {
+            transport_function(
+                self.transport_priv,
+                self.dev,
+                request_buf.as_ptr() as *const c_void,
+                request_buf.len(),
+                response_buf.as_mut_ptr() as *mut c_void,
+                response_buf.len(),
+            ) as i32
+        };
+        to_result(length)?;
+
+        if (length as usize) < header_size {
+            return Ok(length); // Truncated response is handled by callers
+        }
+        if response.code == SPDM_ERROR {
+            if length as usize >= core::mem::size_of::<SpdmErrorRsp>() {
+                // SAFETY: The response buffer will be at least as large as
+                // `SpdmErrorRsp` so we can cast the buffer to `SpdmErrorRsp` which
+                // is a packed struct.
+                self.spdm_err(unsafe { &*(response_buf.as_ptr() as *const SpdmErrorRsp) })?;
+            } else {
+                return Err(EINVAL);
+            }
+        }
+
+        if response.code != request.code & !SPDM_REQ {
+            pr_err!(
+                "Response code {:#x} does not match request code {:#x}\n",
+                response.code,
+                request.code
+            );
+            to_result(-(bindings::EPROTO as i32))?;
+        }
+
+        Ok(length)
+    }
+}

lib/rspdm/validator.rs new file +53 -0

new file mode 100644
index 000000000000..a0a3a2f46952
@@ -0,0 +1,66 @@
+// SPDX-License-Identifier: GPL-2.0
+
+// Copyright (C) 2024 Western Digital
+
+//! Related structs and their Validate implementations.
+//!
+//! Rust implementation of the DMTF Security Protocol and Data Model (SPDM)
+//! <https://www.dmtf.org/dsp/DSP0274>
+
+use crate::consts::SpdmErrorCode;
+use core::mem;
+use kernel::prelude::*;
+use kernel::{
+    error::{code::EINVAL, Error},
+    validate::{Unvalidated, Validate},
+};
+
+#[repr(C, packed)]
+pub(crate) struct SpdmHeader {
+    pub(crate) version: u8,
+    pub(crate) code: u8, /* RequestResponseCode */
+    pub(crate) param1: u8,
+    pub(crate) param2: u8,
+}
+
+impl Validate<&Unvalidated<[u8]>> for &SpdmHeader {
+    type Err = Error;
+
+    fn validate(unvalidated: &Unvalidated<[u8]>) -> Result<Self, Self::Err> {
+        let raw = unvalidated.raw();
+        if raw.len() < mem::size_of::<SpdmHeader>() {
+            return Err(EINVAL);
+        }
+
+        let ptr = raw.as_ptr();
+        // CAST: `SpdmHeader` only contains integers and has `repr(C)`.
+        let ptr = ptr.cast::<SpdmHeader>();
+        // SAFETY: `ptr` came from a reference and the cast above is valid.
+        Ok(unsafe { &*ptr })
+    }
+}
+
+impl Validate<&mut Unvalidated<[u8]>> for &mut SpdmHeader {
+    type Err = Error;
+
+    fn validate(unvalidated: &mut Unvalidated<[u8]>) -> Result<Self, Self::Err> {
+        let raw = unvalidated.raw_mut();
+        if raw.len() < mem::size_of::<SpdmHeader>() {
+            return Err(EINVAL);
+        }
+
+        let ptr = raw.as_mut_ptr();
+        // CAST: `SpdmHeader` only contains integers and has `repr(C)`.

rust/bindings/bindings_helper.h +1 -0

 #include <linux/usb.h>
+#include <linux/uaccess.h>
 #include <linux/wait.h>
 #include <linux/workqueue.h>
 #include <linux/xarray.h>

Quoted 6 lines · On Wed, 11 Feb 2026 13:29:15 +1000 [email protected] wrote:

From: Alistair Francis <[email protected]>

This is the initial commit of the Rust SPDM library. It is based on and compatible with the C SPDM library in the kernel (lib/spdm).

Signed-off-by Alistair Francis <[email protected]>

The comments that follow are based on my very limited rust knowledge. Hence may be garbage.

Quoted 28 lines

---
 MAINTAINERS                     |  12 ++
 include/linux/spdm.h            |  39 ++++++
 lib/Kconfig                     |  17 +++
 lib/Makefile                    |   2 +
 lib/rspdm/Makefile              |  10 ++
 lib/rspdm/consts.rs             | 117 +++++++++++++++++
 lib/rspdm/lib.rs                | 119 +++++++++++++++++
 lib/rspdm/state.rs              | 220 ++++++++++++++++++++++++++++++++
 lib/rspdm/validator.rs          |  66 ++++++++++
 rust/bindings/bindings_helper.h |   2 +
 rust/kernel/error.rs            |   3 +
 11 files changed, 607 insertions(+)
 create mode 100644 include/linux/spdm.h
 create mode 100644 lib/rspdm/Makefile
 create mode 100644 lib/rspdm/consts.rs
 create mode 100644 lib/rspdm/lib.rs
 create mode 100644 lib/rspdm/state.rs
 create mode 100644 lib/rspdm/validator.rs

MAINTAINERS +0 -0

index 149deedafe2c..a5c4ec16081c 100644
@@ -23693,6 +23693,18 @@ M:   Security Officers <[email protected]>
 S:   Supported
 F:   Documentation/process/security-bugs.rst
 

MAINTAINERS M: Security Officers <[email protected]> · line 23697

Quoted 2 lines

MAINTAINERS +2 -0

+SECURITY PROTOCOL AND DATA MODEL (SPDM)
+M:   Jonathan Cameron <[email protected]>

Evil way to get me to learn rust. Ah well, I guess I can't put it off for ever.

Quoted 25 lines

MAINTAINERS +9 -0

+M:   Lukas Wunner <[email protected]>
+M:   Alistair Francis <[email protected]>
+L:   [email protected]
+L:   [email protected]
+L:   [email protected]
+S:   Maintained
+T:   git git://git.kernel.org/pub/scm/linux/kernel/git/devsec/spdm.git
+F:   include/linux/spdm.h
+F:   lib/rspdm/
 
 

lib/rspdm/consts.rs new file +7 -0

new file mode 100644
index 000000000000..40ce60eba2f3
@@ -0,0 +1,117 @@
+// SPDX-License-Identifier: GPL-2.0
+
+// Copyright (C) 2024 Western Digital
+
+//! Constants used by the library
+//!
+//! Rust implementation of the DMTF Security Protocol and Data Model (SPDM)

lib/rspdm/consts.rs line 17

Quoted 10 lines

lib/rspdm/consts.rs new file +10 -0

+//! <https://www.dmtf.org/dsp/DSP0274>
+
+pub(crate) const SPDM_REQ: u8 = 0x80;
+pub(crate) const SPDM_ERROR: u8 = 0x7f;
+
+#[expect(dead_code)]
+#[derive(Clone, Copy)]
+pub(crate) enum SpdmErrorCode {
+    InvalidRequest = 0x01,
+    InvalidSession = 0x02,

This is reserved by the time we reach 1.2.1 and disappeared somewhere in the middle of 1.1.0 (present) and 1.1.2 (reserved) Probably good to leave some breadcrumbs for what spec versions could use this error code. That will reduce confusion for future readers. You have this info in the parsing code, but I'd like it here as well.

Quoted 23 lines

lib/rspdm/consts.rs new file +23 -0

+    Busy = 0x03,
+    UnexpectedRequest = 0x04,
+    Unspecified = 0x05,
+    DecryptError = 0x06,
+    UnsupportedRequest = 0x07,
+    RequestInFlight = 0x08,
+    InvalidResponseCode = 0x09,
+    SessionLimitExceeded = 0x0a,
+    SessionRequired = 0x0b,
+    ResetRequired = 0x0c,
+    ResponseTooLarge = 0x0d,
+    RequestTooLarge = 0x0e,
+    LargeResponse = 0x0f,
+    MessageLost = 0x10,
+    InvalidPolicy = 0x11,
+    VersionMismatch = 0x41,
+    ResponseNotReady = 0x42,
+    RequestResynch = 0x43,
+    OperationFailed = 0x44,
+    NoPendingRequests = 0x45,
+    VendorDefinedError = 0xff,
+}
+

lib/rspdm/consts.rs line 46

Quoted 6 lines

lib/rspdm/consts.rs new file +6 -0

+impl core::fmt::LowerHex for SpdmErrorCode {
+    /// A debug print format for the SpdmSessionInfo struct
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        match self {
+            SpdmErrorCode::InvalidRequest => {
+                writeln!(f, "0x01")?;

No way to get a string from an enum value in rust?

Having to check these against the enum above is a bit tedious.

Quoted 15 lines

lib/rspdm/consts.rs new file +5 -0

+            }
 
+        }
+        Ok(())
+    }
+}

lib/rspdm/lib.rs new file +3 -0

new file mode 100644
index 000000000000..2bb716140e0a
@@ -0,0 +1,119 @@
+// SPDX-License-Identifier: GPL-2.0
+
+// Copyright (C) 2024 Western Digital

lib/rspdm/lib.rs line 13

Quoted 10 lines

lib/rspdm/lib.rs new file +10 -0

+
+//! Top level library for SPDM
+//!
+//! Rust implementation of the DMTF Security Protocol and Data Model (SPDM)
+//! <https://www.dmtf.org/dsp/DSP0274>
+//!
+//! Top level library, including C compatible public functions to be called
+//! from other subsytems.
+//!
+//! This mimics the C SPDM implementation in the kernel

The one that never gets merged if this goes according to plan ;)

Quoted 26 lines

lib/rspdm/state.rs new file +20 -0

new file mode 100644
index 000000000000..68861f30e3fa
@@ -0,0 +1,220 @@
+// SPDX-License-Identifier: GPL-2.0
+
+// Copyright (C) 2024 Western Digital
+
+//! The `SpdmState` struct and implementation.
+//!
+//! Rust implementation of the DMTF Security Protocol and Data Model (SPDM)
+//! <https://www.dmtf.org/dsp/DSP0274>
+
+use core::ffi::c_void;
+use kernel::prelude::*;
+use kernel::{
+    bindings,
+    error::{code::EINVAL, to_result, Error},
+    validate::Untrusted,
+};
+
+use crate::consts::{SpdmErrorCode, SPDM_ERROR, SPDM_REQ};
+use crate::validator::{SpdmErrorRsp, SpdmHeader};
+

lib/rspdm/state.rs line 30

Quoted 10 lines

lib/rspdm/state.rs new file +10 -0

+/// The current SPDM session state for a device. Based on the
+/// C `struct spdm_state`.
+///
+/// `dev`: Responder device.  Used for error reporting and passed to @transport.
+/// `transport`: Transport function to perform one message exchange.
+/// `transport_priv`: Transport private data.
+/// `transport_sz`: Maximum message size the transport is capable of (in bytes).
+///  Used as DataTransferSize in GET_CAPABILITIES exchange.
+/// `keyring`: Keyring against which to check the first certificate in
+///  responder's certificate chain.

Given the discussions, seems this will go away (for now anyway).

Quoted 39 lines

lib/rspdm/state.rs new file +38 -0

+/// `validate`: Function to validate additional leaf certificate requirements.
+///
+/// `version`: Maximum common supported version of requester and responder.
+///  Negotiated during GET_VERSION exchange.
+#[expect(dead_code)]
+pub struct SpdmState {
+    pub(crate) dev: *mut bindings::device,
+    pub(crate) transport: bindings::spdm_transport,
+    pub(crate) transport_priv: *mut c_void,
+    pub(crate) transport_sz: u32,
+    pub(crate) keyring: *mut bindings::key,
+    pub(crate) validate: bindings::spdm_validate,
+
+    // Negotiated state
+    pub(crate) version: u8,
+}
+
+impl SpdmState {
+    pub(crate) fn new(
+        dev: *mut bindings::device,
+        transport: bindings::spdm_transport,
+        transport_priv: *mut c_void,
+        transport_sz: u32,
+        keyring: *mut bindings::key,
+        validate: bindings::spdm_validate,
+    ) -> Self {
+        SpdmState {
+            dev,
+            transport,
+            transport_priv,
+            transport_sz,
+            keyring,
+            validate,
+            version: 0x10,
+        }
+    }
 
+
+    /// Start a SPDM exchange

lib/rspdm/state.rs

Quoted 10 lines

lib/rspdm/state.rs new file +10 -0

+    ///
+    /// The data in `request_buf` is sent to the device and the response is
+    /// stored in `response_buf`.
+    pub(crate) fn spdm_exchange(
+        &self,
+        request_buf: &mut [u8],
+        response_buf: &mut [u8],
+    ) -> Result<i32, Error> {
+        let header_size = core::mem::size_of::<SpdmHeader>();
+        let request: &mut SpdmHeader = Untrusted::new_mut(request_buf).validate_mut()?;

Why are we treating the request, which doesn't come from the device as untrusted? Just for convenience on checking we formatted it right at the upper levels or is the idea that might ultimately be coming from userspace?

Quoted 103 lines

lib/rspdm/state.rs new file +43 -0

+        let response: &SpdmHeader = Untrusted::new_ref(response_buf).validate()?;
+
+        let transport_function = self.transport.ok_or(EINVAL)?;
+        // SAFETY: `transport_function` is provided by the new(), we are
+        // calling the function.
+        let length = unsafe {
+            transport_function(
+                self.transport_priv,
+                self.dev,
+                request_buf.as_ptr() as *const c_void,
+                request_buf.len(),
+                response_buf.as_mut_ptr() as *mut c_void,
+                response_buf.len(),
+            ) as i32
+        };
+        to_result(length)?;
+
+        if (length as usize) < header_size {
+            return Ok(length); // Truncated response is handled by callers
+        }
+        if response.code == SPDM_ERROR {
+            if length as usize >= core::mem::size_of::<SpdmErrorRsp>() {
+                // SAFETY: The response buffer will be at least as large as
+                // `SpdmErrorRsp` so we can cast the buffer to `SpdmErrorRsp` which
+                // is a packed struct.
+                self.spdm_err(unsafe { &*(response_buf.as_ptr() as *const SpdmErrorRsp) })?;
+            } else {
+                return Err(EINVAL);
+            }
+        }
+
+        if response.code != request.code & !SPDM_REQ {
+            pr_err!(
+                "Response code {:#x} does not match request code {:#x}\n",
+                response.code,
+                request.code
+            );
+            to_result(-(bindings::EPROTO as i32))?;
+        }
+
+        Ok(length)
+    }
+}

lib/rspdm/validator.rs new file +53 -0

new file mode 100644
index 000000000000..a0a3a2f46952
@@ -0,0 +1,66 @@
+// SPDX-License-Identifier: GPL-2.0
+
+// Copyright (C) 2024 Western Digital
+
+//! Related structs and their Validate implementations.
+//!
+//! Rust implementation of the DMTF Security Protocol and Data Model (SPDM)
+//! <https://www.dmtf.org/dsp/DSP0274>
+
+use crate::consts::SpdmErrorCode;
+use core::mem;
+use kernel::prelude::*;
+use kernel::{
+    error::{code::EINVAL, Error},
+    validate::{Unvalidated, Validate},
+};
+
+#[repr(C, packed)]
+pub(crate) struct SpdmHeader {
+    pub(crate) version: u8,
+    pub(crate) code: u8, /* RequestResponseCode */
+    pub(crate) param1: u8,
+    pub(crate) param2: u8,
+}
+
+impl Validate<&Unvalidated<[u8]>> for &SpdmHeader {
+    type Err = Error;
+
+    fn validate(unvalidated: &Unvalidated<[u8]>) -> Result<Self, Self::Err> {
+        let raw = unvalidated.raw();
+        if raw.len() < mem::size_of::<SpdmHeader>() {
+            return Err(EINVAL);
+        }
+
+        let ptr = raw.as_ptr();
+        // CAST: `SpdmHeader` only contains integers and has `repr(C)`.
+        let ptr = ptr.cast::<SpdmHeader>();
+        // SAFETY: `ptr` came from a reference and the cast above is valid.
+        Ok(unsafe { &*ptr })
+    }
+}
+
+impl Validate<&mut Unvalidated<[u8]>> for &mut SpdmHeader {
+    type Err = Error;
+
+    fn validate(unvalidated: &mut Unvalidated<[u8]>) -> Result<Self, Self::Err> {
+        let raw = unvalidated.raw_mut();
+        if raw.len() < mem::size_of::<SpdmHeader>() {
+            return Err(EINVAL);
+        }
+
+        let ptr = raw.as_mut_ptr();
+        // CAST: `SpdmHeader` only contains integers and has `repr(C)`.

lib/rspdm/validator.rs line 63

Quoted 10 lines

lib/rspdm/validator.rs new file +10 -0

+        let ptr = ptr.cast::<SpdmHeader>();
+        // SAFETY: `ptr` came from a reference and the cast above is valid.
+        Ok(unsafe { &mut *ptr })
+    }
+}
+
+#[repr(C, packed)]
+pub(crate) struct SpdmErrorRsp {
+    pub(crate) version: u8,
+    pub(crate) code: u8,

Maybe document here that this will always be SPDM_ERROR 0x7F

rust/bindings/bindings_helper.h line 87

Quoted 12 lines

lib/rspdm/validator.rs new file +3 -0

+    pub(crate) error_code: SpdmErrorCode,
+    pub(crate) error_data: u8,
+}

rust/bindings/bindings_helper.h +1 -0

index 0075c4b62c29..5043eee2a8d6 100644
@@ -84,7 +84,9 @@
 #include <linux/slab.h>
 #include <linux/task_work.h>
 #include <linux/tracepoint.h>
+#include <linux/spdm.h>

Smells like this is alphabetical order. So move it up a bit?

Quoted 5 lines

rust/bindings/bindings_helper.h +1 -0

 #include <linux/usb.h>
+#include <linux/uaccess.h>
 #include <linux/wait.h>
 #include <linux/workqueue.h>
 #include <linux/xarray.h>

drivers/pci/Kconfig +6 -0

index e3f848ffb52a..7ea403799d78 100644
@@ -125,6 +125,22 @@ config PCI_ATS
  config PCI_IDE
  	bool
 
+config PCI_CMA
+	bool "Component Measurement and Authentication (CMA-SPDM)"
+	select CRYPTO_ECDSA
+	select CRYPTO_RSA
+	select CRYPTO_SHA256
+	select CRYPTO_SHA512

drivers/pci/Kconfig +0 -0

  config PCI_TSM
  	bool "PCI TSM: Device security protocol support"
  	select PCI_IDE

drivers/pci/Makefile +2 -0

index e10cfe5a280b..f026f5dbb938 100644
@@ -40,6 +40,8 @@ obj-$(CONFIG_PCI_DYNAMIC_OF_NODES) += of_property.o
  obj-$(CONFIG_PCI_NPEM)		+= npem.o
  obj-$(CONFIG_PCIE_TPH)		+= tph.o
 
+obj-$(CONFIG_PCI_CMA)		+= cma.o
+
  # Endpoint library must be initialized before its users
  obj-$(CONFIG_PCI_ENDPOINT)	+= endpoint/
 

drivers/pci/cma.c new file +13 -0

new file mode 100644
index 000000000000..7463cd1179f0
@@ -0,0 +1,101 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Component Measurement and Authentication (CMA-SPDM, PCIe r6.2 sec 6.31)
+ *
+ * Copyright (C) 2021 Huawei
+ *     Jonathan Cameron <[email protected]>
+ *
+ * Copyright (C) 2022-24 Intel Corporation
+ */
+
+#define dev_fmt(fmt) "CMA: " fmt
+
+#include <linux/pci.h>

 /// The current SPDM session state for a device. Based on the /// C struct spdm_state.

lib/rspdm/state.rs +1 -1

@@ -61,7 +64,7 @@ pub(crate) fn new(
              transport_sz,
              keyring,
              validate,
-            version: 0x10,
+            version: SPDM_MIN_VER,
          }
      }

(quoted diff) +0 -0

@@ -217,4 +220,53 @@ pub(crate) fn spdm_exchange(

         Ok(length)
     }
+
+    /// Negoiate a supported SPDM version and store the information

+    /// in the SpdmState.
+    pub(crate) fn get_version(&mut self) -> Result<(), Error> { +        let mut request = GetVersionReq::default();
+        request.version = self.version;
+
+        // SAFETY: request is repr(C) and packed, so we can convert it to a slice
+        let request_buf = unsafe {
+            from_raw_parts_mut(
+                &mut request as *mut _ as *mut u8,

+                core::mem::size_of::<GetVersionReq>(), +            )
+        };
+
+        let mut response_vec: KVec<u8> = KVec::with_capacity(SPDM_GET_VERSION_LEN, GFP_KERNEL)?; +        // SAFETY: request is repr(C) and packed, so we can convert it to a slice

From: Alistair Francis <[email protected]>

Support the GET_VERSION SPDM command.

Signed-off-by Alistair Francis <[email protected]>

---
 lib/rspdm/consts.rs    | 17 +++++++++++
 lib/rspdm/lib.rs       |  6 +++-
 lib/rspdm/state.rs     | 58 ++++++++++++++++++++++++++++++++++--
 lib/rspdm/validator.rs | 67 ++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 144 insertions(+), 4 deletions(-)

lib/rspdm/consts.rs +0 -0

index 40ce60eba2f3..38f48f0863e2 100644

lib/rspdm/lib.rs +4 -0

+    if let Err(e) = state.get_version() {
+        return e.to_errno() as c_int;
+    }
+
     0
 }
 

lib/rspdm/state.rs +1 -0

index 68861f30e3fa..3ad53ec05044 100644
@@ -8,6 +8,7 @@
 //! <https://www.dmtf.org/dsp/DSP0274>
 
 use core::ffi::c_void;
+use core::slice::from_raw_parts_mut;
 use kernel::prelude::*;
 use kernel::{
     bindings,

lib/rspdm/state.rs +14 -0

         }
     }
 

@@ -217,4 +220,53 @@ pub(crate) fn spdm_exchange(
 
         Ok(length)
     }
+
+    /// Negoiate a supported SPDM version and store the information
+    /// in the `SpdmState`.
+    pub(crate) fn get_version(&mut self) -> Result<(), Error> {
+        let mut request = GetVersionReq::default();
+        request.version = self.version;
+
+        // SAFETY: `request` is repr(C) and packed, so we can convert it to a slice
+        let request_buf = unsafe {
+            from_raw_parts_mut(
+                &mut request as *mut _ as *mut u8,
+                core::mem::size_of::<GetVersionReq>(),
+            )
+        };

lib/rspdm/state.rs +14 -0

+
+            if version >= self.version && version <= SPDM_MAX_VER {
+                self.version = version;
+                foundver = true;
+            }
+        }
+
+        if !foundver {
+            pr_err!("No common supported version\n");
+            to_result(-(bindings::EPROTO as i32))?;
+        }
+
+        Ok(())
+    }
 }

lib/rspdm/validator.rs +3 -0

index a0a3a2f46952..f69be6aa6280 100644
@@ -7,6 +7,7 @@
 //! Rust implementation of the DMTF Security Protocol and Data Model (SPDM)
 //! <https://www.dmtf.org/dsp/DSP0274>
 
+use crate::bindings::{__IncompleteArrayField, __le16};
 use crate::consts::SpdmErrorCode;
 use core::mem;
 use kernel::prelude::*;

@@ -15,6 +16,8 @@
     validate::{Unvalidated, Validate},
 };
 
+use crate::consts::SPDM_GET_VERSION;
+
 #[repr(C, packed)]
 pub(crate) struct SpdmHeader {
     pub(crate) version: u8,

lib/rspdm/validator.rs +16 -0

+            code: SPDM_GET_VERSION,
+            param1: 0,
+            param2: 0,
+        }
+    }
+}
+
+#[repr(C, packed)]
+pub(crate) struct GetVersionRsp {
+    pub(crate) version: u8,
+    pub(crate) code: u8,
+    param1: u8,
+    param2: u8,
+    reserved: u8,
+    pub(crate) version_number_entry_count: u8,
+    pub(crate) version_number_entries: __IncompleteArrayField<__le16>,

lib/rspdm/validator.rs +5 -0

+        }
+
+        Ok(rsp)
+    }
+}

Quoted 5 lines · On Wed, 11 Feb 2026 13:29:19 +1000 [email protected] wrote:

From: Alistair Francis <[email protected]>

Support the GET_VERSION SPDM command.

Signed-off-by Alistair Francis <[email protected]>

Hi Alistair,

Various minor comments inline. Biggest one is what I think is some confusing le16 handling that to me is in the wrong place.

Jonathan

Quoted 11 lines

---
 lib/rspdm/consts.rs    | 17 +++++++++++
 lib/rspdm/lib.rs       |  6 +++-
 lib/rspdm/state.rs     | 58 ++++++++++++++++++++++++++++++++++--
 lib/rspdm/validator.rs | 67 ++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 144 insertions(+), 4 deletions(-)

lib/rspdm/consts.rs +0 -0

index 40ce60eba2f3..38f48f0863e2 100644

lib/rspdm/consts.rs fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result { · line 134

Quoted 7 lines

lib/rspdm/consts.rs +3 -0

@@ -115,3 +129,6 @@ fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
         Ok(())
     }
 }
+
+pub(crate) const SPDM_GET_VERSION: u8 = 0x84;
+pub(crate) const SPDM_GET_VERSION_LEN: usize = mem::size_of::<SpdmHeader>() + 255;

I'd either add a comment on where the 255 comes from. Also do we have a U8_MAX definition we can use? Or some way to get it from code?

lib/rspdm/lib.rs line 111

Quoted 11 lines

lib/rspdm/lib.rs +1 -1

index 2bb716140e0a..08abcbb21247 100644
@@ -108,7 +108,11 @@
 /// Return 0 on success or a negative errno.  In particular, -EPROTONOSUPPORT
 /// indicates authentication is not supported by the device.
 #[no_mangle]
-pub unsafe extern "C" fn spdm_authenticate(_state: &'static mut SpdmState) -> c_int {
+pub unsafe extern "C" fn spdm_authenticate(state: &'static mut SpdmState) -> c_int {

Is there more to this rename than it appears? Can it get pushed back to earlier patch?

Quoted 24 lines

lib/rspdm/lib.rs +4 -0

+    if let Err(e) = state.get_version() {
+        return e.to_errno() as c_int;
+    }
+
     0
 }
 

lib/rspdm/state.rs +1 -0

index 68861f30e3fa..3ad53ec05044 100644
@@ -8,6 +8,7 @@
 //! <https://www.dmtf.org/dsp/DSP0274>
 
 use core::ffi::c_void;
+use core::slice::from_raw_parts_mut;
 use kernel::prelude::*;
 use kernel::{
     bindings,

@@ -15,8 +16,10 @@
     validate::Untrusted,
 };
 

lib/rspdm/state.rs line 20

Quoted 4 lines

lib/rspdm/state.rs +2 -2

-use crate::consts::{SpdmErrorCode, SPDM_ERROR, SPDM_REQ};
-use crate::validator::{SpdmErrorRsp, SpdmHeader};
+use crate::consts::{
+    SpdmErrorCode, SPDM_ERROR, SPDM_GET_VERSION_LEN, SPDM_MAX_VER, SPDM_MIN_VER, SPDM_REQ,

Is the Rust linter fussy about these being on one line? Feels like we'd get less churn over time if we formatted this as one per line.

Quoted 4 lines

lib/rspdm/state.rs +2 -0

+};
+use crate::validator::{GetVersionReq, GetVersionRsp, SpdmErrorRsp, SpdmHeader};
 

lib/rspdm/state.rs pub(crate) fn new( · line 67

Quoted 8 lines

lib/rspdm/state.rs +1 -1

 /// The current SPDM session state for a device. Based on the
 /// C `struct spdm_state`.

@@ -61,7 +64,7 @@ pub(crate) fn new(
             transport_sz,
             keyring,
             validate,
-            version: 0x10,
+            version: SPDM_MIN_VER,

Pull that def back to earlier patch to keep the churn confined.

Quoted 26 lines

lib/rspdm/state.rs +18 -0

         }
     }
 

@@ -217,4 +220,53 @@ pub(crate) fn spdm_exchange(
 
         Ok(length)
     }
+
+    /// Negoiate a supported SPDM version and store the information
+    /// in the `SpdmState`.
+    pub(crate) fn get_version(&mut self) -> Result<(), Error> {
+        let mut request = GetVersionReq::default();
+        request.version = self.version;
+
+        // SAFETY: `request` is repr(C) and packed, so we can convert it to a slice
+        let request_buf = unsafe {
+            from_raw_parts_mut(
+                &mut request as *mut _ as *mut u8,
+                core::mem::size_of::<GetVersionReq>(),
+            )
+        };
+
+        let mut response_vec: KVec<u8> = KVec::with_capacity(SPDM_GET_VERSION_LEN, GFP_KERNEL)?;
+        // SAFETY: `request` is repr(C) and packed, so we can convert it to a slice
+        let response_buf =

lib/rspdm/state.rs pub(crate) fn spdm_exchange( · line 246

Quoted 6 lines

lib/rspdm/state.rs +6 -0

+            unsafe { from_raw_parts_mut(response_vec.as_mut_ptr(), SPDM_GET_VERSION_LEN) };
+
+        let rc = self.spdm_exchange(request_buf, response_buf)?;
+
+        // SAFETY: `rc` is the length of data read, which will be smaller
+        // then the capacity of the vector

than?

lib/rspdm/state.rs pub(crate) fn spdm_exchange( · line 255

Quoted 10 lines

lib/rspdm/state.rs +9 -0

+        unsafe { response_vec.inc_len(rc as usize) };
+
+        let response: &mut GetVersionRsp = Untrusted::new_mut(&mut response_vec).validate_mut()?;
+
+        let mut foundver = false;
+        for i in 0..response.version_number_entry_count {
+            // Creating a reference on a packed struct will result in
+            // undefined behaviour, so we operate on the raw data directly
+            let unaligned = core::ptr::addr_of_mut!(response.version_number_entries) as *mut u16;

Maybe pull that out of the loop like you do below?

lib/rspdm/state.rs pub(crate) fn spdm_exchange( · line 257

Quoted 3 lines

lib/rspdm/state.rs +2 -0

+            let addr = unaligned.wrapping_add(i as usize);
+            let version = (unsafe { core::ptr::read_unaligned::<u16>(addr) } >> 8) as u8;

Given the endian conversion below, this is correct, but I think leaving it as the __le16 until here is better. We could also just pull out the correct byte and ignore the other one.

It's a spec quirk that they decided to have it defined as a __le16 rather than u8[2] as the fields are confined one byte or the other.

I wonder if we should also reject any alpha versions? I.e. check the bottom 4 bits are 0.

Quoted 32 lines

lib/rspdm/state.rs +14 -0

+
+            if version >= self.version && version <= SPDM_MAX_VER {
+                self.version = version;
+                foundver = true;
+            }
+        }
+
+        if !foundver {
+            pr_err!("No common supported version\n");
+            to_result(-(bindings::EPROTO as i32))?;
+        }
+
+        Ok(())
+    }
 }

lib/rspdm/validator.rs +1 -0

index a0a3a2f46952..f69be6aa6280 100644
@@ -7,6 +7,7 @@
 //! Rust implementation of the DMTF Security Protocol and Data Model (SPDM)
 //! <https://www.dmtf.org/dsp/DSP0274>
 
+use crate::bindings::{__IncompleteArrayField, __le16};
 use crate::consts::SpdmErrorCode;
 use core::mem;
 use kernel::prelude::*;

@@ -15,6 +16,8 @@
     validate::{Unvalidated, Validate},
 };
 

lib/rspdm/validator.rs pub(crate) struct SpdmErrorRsp { · line 71

Quoted 11 lines

lib/rspdm/validator.rs +4 -0

+use crate::consts::SPDM_GET_VERSION;
+
 #[repr(C, packed)]
 pub(crate) struct SpdmHeader {
     pub(crate) version: u8,

@@ -64,3 +67,67 @@ pub(crate) struct SpdmErrorRsp {
     pub(crate) error_code: SpdmErrorCode,
     pub(crate) error_data: u8,
 }
+
+#[repr(C, packed)]

Why packed?

lib/rspdm/validator.rs pub(crate) struct SpdmErrorRsp { · line 82

Quoted 12 lines

lib/rspdm/validator.rs +11 -0

+pub(crate) struct GetVersionReq {
+    pub(crate) version: u8,
+    pub(crate) code: u8,
+    pub(crate) param1: u8,
+    pub(crate) param2: u8,
+}
+
+impl Default for GetVersionReq {
+    fn default() -> Self {
+        GetVersionReq {
+            version: 0,

Given this only takes one value we could default it to 0x10 (even though it's written above to keep the state machine in sync).

Quoted 24 lines

lib/rspdm/validator.rs +23 -0

+            code: SPDM_GET_VERSION,
+            param1: 0,
+            param2: 0,
+        }
+    }
+}
+
+#[repr(C, packed)]
+pub(crate) struct GetVersionRsp {
+    pub(crate) version: u8,
+    pub(crate) code: u8,
+    param1: u8,
+    param2: u8,
+    reserved: u8,
+    pub(crate) version_number_entry_count: u8,
+    pub(crate) version_number_entries: __IncompleteArrayField<__le16>,
+}
+
+impl Validate<&mut Unvalidated<KVec<u8>>> for &mut GetVersionRsp {
+    type Err = Error;
+
+    fn validate(unvalidated: &mut Unvalidated<KVec<u8>>) -> Result<Self, Self::Err> {
+        let raw = unvalidated.raw_mut();

lib/rspdm/validator.rs pub(crate) struct SpdmErrorRsp { · line 108

Quoted 3 lines

lib/rspdm/validator.rs +3 -0

+        if raw.len() < mem::size_of::<GetVersionRsp>() {
+            return Err(EINVAL);
+        }

I guess it probably belongs at the header validation point rather that here, but can we also check the version matches what was requested. Possibly an additional check here that it is 0x10 (as this one is a special case where only that value is correct).

lib/rspdm/validator.rs pub(crate) struct SpdmErrorRsp { · line 111

Quoted 4 lines

lib/rspdm/validator.rs +3 -0

+
+        let version_number_entries = *(raw.get(5).ok_or(ENOMEM))? as usize;
+        let total_expected_size = version_number_entries * 2 + 6;

Instead of 6 can we use mem::size_of::<GetVersionRsp>()?

Ideally something similar for the 2 as well even if it's a bit verbose. (if I was lazy in the C code you get to make it better here :)

lib/rspdm/validator.rs pub(crate) struct SpdmErrorRsp { · line 122

Quoted 13 lines

lib/rspdm/validator.rs +11 -0

+        if raw.len() < total_expected_size {
+            return Err(EINVAL);
+        }
+
+        let ptr = raw.as_mut_ptr();
+        // CAST: `GetVersionRsp` only contains integers and has `repr(C)`.
+        let ptr = ptr.cast::<GetVersionRsp>();
+        // SAFETY: `ptr` came from a reference and the cast above is valid.
+        let rsp: &mut GetVersionRsp = unsafe { &mut *ptr };
+
+        // Creating a reference on a packed struct will result in

Silly question, but why is it packed? We might need to do this for some structures in SPDM but do we have transports that mess up the alignment enough that where the messages themselves don't need to be packed we have to mark the structures so anyway? Probably good to document this somewhere.

lib/rspdm/validator.rs pub(crate) struct SpdmErrorRsp { · line 128

Quoted 7 lines

lib/rspdm/validator.rs +6 -0

+        // undefined behaviour, so we operate on the raw data directly
+        let unaligned = core::ptr::addr_of_mut!(rsp.version_number_entries) as *mut u16;
+        for version_offset in 0..version_number_entries {
+            let addr = unaligned.wrapping_add(version_offset);
+            let version = unsafe { core::ptr::read_unaligned::<u16>(addr) };
+            unsafe { core::ptr::write_unaligned::<u16>(addr, version.to_le()) }

I'd like to see a comment on why this seems to be doing an endian swap if we are on big endian. Looking back at the c code, it has an endian swap but only as part of the search for a version to use (finding the largest both device and and kernel support).

Maybe I'm reading it wrong but isn't this putting cpu endian data into a structure element that is of type __le16?

Quoted 6 lines

lib/rspdm/validator.rs +5 -0

+        }
+
+        Ok(rsp)
+    }
+}

This is a public function that matches the C implementation, hence the arguments being fixed in the previous patch.

This is just how the linter formats it when I run LLVM=1 make rustfmt. I don't really want to be manually formatting things

We have size_of, align_of and so on in the prelude, so you can use those directly:

https://rust.docs.kernel.org/kernel/prelude/index.html

Quoted 5 lines

Quoted 5 lines

lib/rspdm/state.rs +2 -0

+            let addr = unaligned.wrapping_add(i as usize);
+            let version = (unsafe { core::ptr::read_unaligned::<u16>(addr) } >> 8) as u8;  

Quoted 2 lines

Given the endian conversion below, this is correct, but I think leaving it as the __le16 until here is better. We could also just pull out the correct byte and ignore the other one.

Hmm... I'm not sure I follow.

The SPDM spec describes this as a u16, so I'm reading the entire value and just taking the upper bits for the Major/Minor version

So I'm not sure what you think I should do differently?

Quoted 5 lines

It's a spec quirk that they decided to have it defined as a __le16 rather than u8[2] as the fields are confined one byte or the other.

I wonder if we should also reject any alpha versions? I.e. check the bottom 4 bits are 0.

Hmmm... That seems a bit unnecessary. Maybe a warning though?

Quoted 33 lines

Quoted 33 lines

lib/rspdm/state.rs +14 -0

+
+            if version >= self.version && version <= SPDM_MAX_VER {
+                self.version = version;
+                foundver = true;
+            }
+        }
+
+        if !foundver {
+            pr_err!("No common supported version\n");
+            to_result(-(bindings::EPROTO as i32))?;
+        }
+
+        Ok(())
+    }
 }

lib/rspdm/validator.rs +1 -0

index a0a3a2f46952..f69be6aa6280 100644
@@ -7,6 +7,7 @@
 //! Rust implementation of the DMTF Security Protocol and Data Model (SPDM)
 //! <https://www.dmtf.org/dsp/DSP0274>
 
+use crate::bindings::{__IncompleteArrayField, __le16};
 use crate::consts::SpdmErrorCode;
 use core::mem;
 use kernel::prelude::*;

@@ -15,6 +16,8 @@
     validate::{Unvalidated, Validate},
 };
 

Quoted 13 lines

lib/rspdm/validator.rs pub(crate) struct SpdmErrorRsp { · line 71

Quoted 11 lines

lib/rspdm/validator.rs +4 -0

+use crate::consts::SPDM_GET_VERSION;
+
 #[repr(C, packed)]
 pub(crate) struct SpdmHeader {
     pub(crate) version: u8,

@@ -64,3 +67,67 @@ pub(crate) struct SpdmErrorRsp {
     pub(crate) error_code: SpdmErrorCode,
     pub(crate) error_data: u8,
 }
+
+#[repr(C, packed)]  

Why packed?

We cast it from a struct to a slice (array), so we need it to be packed to avoid gaps in the slice (array)

Quoted 21 lines

Quoted 5 lines

lib/rspdm/validator.rs +3 -0

+pub(crate) struct GetVersionReq {
+    pub(crate) version: u8,
+    pub(crate) code: u8,

lib/rspdm/validator.rs pub(crate) struct SpdmErrorRsp { · line 128

Quoted 10 lines

lib/rspdm/validator.rs +10 -0

+    pub(crate) param1: u8,
+    pub(crate) param2: u8,
+}
+
+        // undefined behaviour, so we operate on the raw data directly
+        let unaligned = core::ptr::addr_of_mut!(rsp.version_number_entries) as *mut u16;
+        for version_offset in 0..version_number_entries {
+            let addr = unaligned.wrapping_add(version_offset);
+            let version = unsafe { core::ptr::read_unaligned::<u16>(addr) };
+            unsafe { core::ptr::write_unaligned::<u16>(addr, version.to_le()) }  

I'd like to see a comment on why this seems to be doing an endian swap if we are on big endian. Looking back at the c code, it has an endian swap but only as part of the search for a version to use (finding the largest both device and and kernel support).

Quoted 2 lines

Maybe I'm reading it wrong but isn't this putting cpu endian data into a structure element that is of type __le16?

On second thought I don't think this is required at all. It's converting the LE data from the SPDM response to LE. Which is just unnecessary no-op (LE) or a bug (BE) depending on the CPU endianness.

Alistair

Quoted 7 lines

Quoted 6 lines

lib/rspdm/validator.rs +5 -0

+        }
+
+        Ok(rsp)
+    }
+}  

+
+    /// Obtain the supported capabilities from an SPDM session and store the
+    /// information in the SpdmState.
+    pub(crate) fn get_capabilities(&mut self) -> Result<(), Error> { +        let mut request = GetCapabilitiesReq::default(); +        request.version = self.version;
+
+        let (req_sz, rsp_sz) = match self.version {
+            SPDM_VER_10 => (4, 8),
+            SPDM_VER_11 => (8, 8),
+            _ => {
+                request.data_transfer_size = self.transport_sz.to_le();
+                request.max_spdm_msg_size = request.data_transfer_size;

lib/rspdm/state.rs +9 -0

+
+                (
+                    core::mem::size_of::<GetCapabilitiesReq>(),
+                    core::mem::size_of::<GetCapabilitiesRsp>(),
+                )
+            }
+        };
+
+        // SAFETY: `request` is repr(C) and packed, so we can

convert it to a slice
+        let request_buf = unsafe { from_raw_parts_mut(&mut request as *mut _ as *mut u8, req_sz) };
+
+        let mut response_vec: KVec<u8> = KVec::with_capacity(rsp_sz, GFP_KERNEL)?;
+        // SAFETY: request is repr(C) and packed, so we can convert it to a slice

+        let response_buf = unsafe { from_raw_parts_mut(response_vec.as_mut_ptr(), rsp_sz) };

lib/rspdm/state.rs +9 -0

+
+        let rc = self.spdm_exchange(request_buf, response_buf)?;
+
+        if rc < (rsp_sz as i32) {
+            pr_err!("Truncated capabilities response\n");
+            to_result(-(bindings::EIO as i32))?;
+        }
+
+        // SAFETY: `rc` is the length of data read, which will be

smaller
+        // then the capacity of the vector
+        unsafe { response_vec.inc_len(rc as usize) };

lib/rspdm/state.rs +6 -0

+
+        let response: &mut GetCapabilitiesRsp =
+            Untrusted::new_mut(&mut response_vec).validate_mut()?;
+
+        self.rsp_caps = u32::from_le(response.flags);
+        if (self.rsp_caps & SPDM_RSP_MIN_CAPS) != SPDM_RSP_MIN_CAPS

{

From: Alistair Francis <[email protected]>

Support the GET_CAPABILITIES SPDM command.

Signed-off-by Alistair Francis <[email protected]>

---
 lib/rspdm/consts.rs    | 18 ++++++++--
 lib/rspdm/lib.rs       |  4 +++
 lib/rspdm/state.rs     | 68 +++++++++++++++++++++++++++++++++++--
 lib/rspdm/validator.rs | 76 +++++++++++++++++++++++++++++++++++++++++-
 4 files changed, 161 insertions(+), 5 deletions(-)

lib/rspdm/consts.rs +0 -2

index 38f48f0863e2..a6a66e2af1b5 100644
@@ -12,9 +12,7 @@
 
 /* SPDM versions supported by this implementation */
 pub(crate) const SPDM_VER_10: u8 = 0x10;
-#[allow(dead_code)]
 pub(crate) const SPDM_VER_11: u8 = 0x11;
-#[allow(dead_code)]
 pub(crate) const SPDM_VER_12: u8 = 0x12;
 pub(crate) const SPDM_VER_13: u8 = 0x13;
 

lib/rspdm/consts.rs +4 -0

+pub(crate) const SPDM_CHAL_CAP: u32 = 1 << 2;
+
+pub(crate) const SPDM_REQ_CAPS: u32 = SPDM_CERT_CAP | SPDM_CHAL_CAP;
+pub(crate) const SPDM_RSP_MIN_CAPS: u32 = SPDM_CERT_CAP | SPDM_CHAL_CAP;

lib/rspdm/lib.rs +4 -0

index 08abcbb21247..5f6653ada59d 100644
@@ -113,6 +113,10 @@
         return e.to_errno() as c_int;
     }
 
+    if let Err(e) = state.get_capabilities() {
+        return e.to_errno() as c_int;
+    }
+
     0
 }
 

lib/rspdm/state.rs +0 -0

index 3ad53ec05044..0efad7f341cd 100644