mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git
synced 2026-04-18 03:23:53 -04:00
90f7520b76
The boot integrity attribute represents that the CPU or APU is used for the hardware root of trust in the boot process. This bit only represents the CPU/APU and some vendors have other hardware root of trust implementations specific to their designs. Link: https://github.com/fwupd/fwupd/pull/9825 Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca> Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
142 lines
3.6 KiB
C
142 lines
3.6 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/*
|
|
* AMD Secure Processor device driver, security attributes
|
|
*
|
|
* Copyright (C) 2023-2024 Advanced Micro Devices, Inc.
|
|
*
|
|
* Author: Mario Limonciello <mario.limonciello@amd.com>
|
|
*/
|
|
|
|
#include <linux/device.h>
|
|
|
|
#include "psp-dev.h"
|
|
#include "hsti.h"
|
|
|
|
#define PSP_CAPABILITY_PSP_SECURITY_OFFSET 8
|
|
|
|
struct hsti_request {
|
|
struct psp_req_buffer_hdr header;
|
|
u32 hsti;
|
|
} __packed;
|
|
|
|
#define security_attribute_show(name) \
|
|
static ssize_t name##_show(struct device *d, struct device_attribute *attr, \
|
|
char *buf) \
|
|
{ \
|
|
struct sp_device *sp = dev_get_drvdata(d); \
|
|
struct psp_device *psp = sp->psp_data; \
|
|
return sysfs_emit(buf, "%d\n", psp->capability.name); \
|
|
}
|
|
|
|
security_attribute_show(fused_part)
|
|
static DEVICE_ATTR_RO(fused_part);
|
|
security_attribute_show(boot_integrity)
|
|
static DEVICE_ATTR_RO(boot_integrity);
|
|
security_attribute_show(debug_lock_on)
|
|
static DEVICE_ATTR_RO(debug_lock_on);
|
|
security_attribute_show(tsme_status)
|
|
static DEVICE_ATTR_RO(tsme_status);
|
|
security_attribute_show(anti_rollback_status)
|
|
static DEVICE_ATTR_RO(anti_rollback_status);
|
|
security_attribute_show(rpmc_production_enabled)
|
|
static DEVICE_ATTR_RO(rpmc_production_enabled);
|
|
security_attribute_show(rpmc_spirom_available)
|
|
static DEVICE_ATTR_RO(rpmc_spirom_available);
|
|
security_attribute_show(hsp_tpm_available)
|
|
static DEVICE_ATTR_RO(hsp_tpm_available);
|
|
security_attribute_show(rom_armor_enforced)
|
|
static DEVICE_ATTR_RO(rom_armor_enforced);
|
|
|
|
static struct attribute *psp_security_attrs[] = {
|
|
&dev_attr_fused_part.attr,
|
|
&dev_attr_boot_integrity.attr,
|
|
&dev_attr_debug_lock_on.attr,
|
|
&dev_attr_tsme_status.attr,
|
|
&dev_attr_anti_rollback_status.attr,
|
|
&dev_attr_rpmc_production_enabled.attr,
|
|
&dev_attr_rpmc_spirom_available.attr,
|
|
&dev_attr_hsp_tpm_available.attr,
|
|
&dev_attr_rom_armor_enforced.attr,
|
|
NULL
|
|
};
|
|
|
|
static umode_t psp_security_is_visible(struct kobject *kobj, struct attribute *attr, int idx)
|
|
{
|
|
struct device *dev = kobj_to_dev(kobj);
|
|
struct sp_device *sp = dev_get_drvdata(dev);
|
|
struct psp_device *psp = sp->psp_data;
|
|
|
|
if (psp && psp->capability.security_reporting)
|
|
return 0444;
|
|
|
|
return 0;
|
|
}
|
|
|
|
struct attribute_group psp_security_attr_group = {
|
|
.attrs = psp_security_attrs,
|
|
.is_visible = psp_security_is_visible,
|
|
};
|
|
|
|
static int psp_populate_hsti(struct psp_device *psp)
|
|
{
|
|
struct hsti_request *req;
|
|
int ret;
|
|
|
|
/* Are the security attributes already reported? */
|
|
if (psp->capability.security_reporting)
|
|
return 0;
|
|
|
|
/* Allocate command-response buffer */
|
|
req = kzalloc(sizeof(*req), GFP_KERNEL);
|
|
if (!req)
|
|
return -ENOMEM;
|
|
|
|
req->header.payload_size = sizeof(*req);
|
|
|
|
ret = psp_send_platform_access_msg(PSP_CMD_HSTI_QUERY, (struct psp_request *)req);
|
|
if (ret)
|
|
goto out;
|
|
|
|
if (req->header.status != 0) {
|
|
dev_dbg(psp->dev, "failed to populate HSTI state: %d\n", req->header.status);
|
|
ret = -EINVAL;
|
|
goto out;
|
|
}
|
|
|
|
psp->capability.security_reporting = 1;
|
|
psp->capability.raw |= req->hsti << PSP_CAPABILITY_PSP_SECURITY_OFFSET;
|
|
|
|
out:
|
|
kfree(req);
|
|
|
|
return ret;
|
|
}
|
|
|
|
int psp_init_hsti(struct psp_device *psp)
|
|
{
|
|
int ret;
|
|
|
|
if (PSP_FEATURE(psp, HSTI)) {
|
|
ret = psp_populate_hsti(psp);
|
|
if (ret)
|
|
return ret;
|
|
}
|
|
|
|
/*
|
|
* At this stage, if security information hasn't been populated by
|
|
* either the PSP or by the driver through the platform command,
|
|
* then there is nothing more to do.
|
|
*/
|
|
if (!psp->capability.security_reporting)
|
|
return 0;
|
|
|
|
if (psp->capability.tsme_status) {
|
|
if (cc_platform_has(CC_ATTR_HOST_MEM_ENCRYPT))
|
|
dev_notice(psp->dev, "psp: Both TSME and SME are active, SME is unnecessary when TSME is active.\n");
|
|
else
|
|
dev_notice(psp->dev, "psp: TSME enabled\n");
|
|
}
|
|
|
|
return 0;
|
|
}
|