1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * AMD Secure Processor device driver, security attributes 4 * 5 * Copyright (C) 2023-2024 Advanced Micro Devices, Inc. 6 * 7 * Author: Mario Limonciello <mario.limonciello@amd.com> 8 */ 9 10 #include <linux/device.h> 11 12 #include "psp-dev.h" 13 #include "hsti.h" 14 15 #define PSP_CAPABILITY_PSP_SECURITY_OFFSET 8 16 17 struct hsti_request { 18 struct psp_req_buffer_hdr header; 19 u32 hsti; 20 } __packed; 21 22 #define security_attribute_show(name) \ 23 static ssize_t name##_show(struct device *d, struct device_attribute *attr, \ 24 char *buf) \ 25 { \ 26 struct sp_device *sp = dev_get_drvdata(d); \ 27 struct psp_device *psp = sp->psp_data; \ 28 return sysfs_emit(buf, "%d\n", psp->capability.name); \ 29 } 30 31 security_attribute_show(fused_part) 32 static DEVICE_ATTR_RO(fused_part); 33 security_attribute_show(boot_integrity) 34 static DEVICE_ATTR_RO(boot_integrity); 35 security_attribute_show(debug_lock_on) 36 static DEVICE_ATTR_RO(debug_lock_on); 37 security_attribute_show(tsme_status) 38 static DEVICE_ATTR_RO(tsme_status); 39 security_attribute_show(anti_rollback_status) 40 static DEVICE_ATTR_RO(anti_rollback_status); 41 security_attribute_show(rpmc_production_enabled) 42 static DEVICE_ATTR_RO(rpmc_production_enabled); 43 security_attribute_show(rpmc_spirom_available) 44 static DEVICE_ATTR_RO(rpmc_spirom_available); 45 security_attribute_show(hsp_tpm_available) 46 static DEVICE_ATTR_RO(hsp_tpm_available); 47 security_attribute_show(rom_armor_enforced) 48 static DEVICE_ATTR_RO(rom_armor_enforced); 49 50 static struct attribute *psp_security_attrs[] = { 51 &dev_attr_fused_part.attr, 52 &dev_attr_boot_integrity.attr, 53 &dev_attr_debug_lock_on.attr, 54 &dev_attr_tsme_status.attr, 55 &dev_attr_anti_rollback_status.attr, 56 &dev_attr_rpmc_production_enabled.attr, 57 &dev_attr_rpmc_spirom_available.attr, 58 &dev_attr_hsp_tpm_available.attr, 59 &dev_attr_rom_armor_enforced.attr, 60 NULL 61 }; 62 63 static umode_t psp_security_is_visible(struct kobject *kobj, struct attribute *attr, int idx) 64 { 65 struct device *dev = kobj_to_dev(kobj); 66 struct sp_device *sp = dev_get_drvdata(dev); 67 struct psp_device *psp = sp->psp_data; 68 69 if (psp && psp->capability.security_reporting) 70 return 0444; 71 72 return 0; 73 } 74 75 struct attribute_group psp_security_attr_group = { 76 .attrs = psp_security_attrs, 77 .is_visible = psp_security_is_visible, 78 }; 79 80 static int psp_populate_hsti(struct psp_device *psp) 81 { 82 struct hsti_request *req; 83 int ret; 84 85 /* Are the security attributes already reported? */ 86 if (psp->capability.security_reporting) 87 return 0; 88 89 /* Allocate command-response buffer */ 90 req = kzalloc(sizeof(*req), GFP_KERNEL); 91 if (!req) 92 return -ENOMEM; 93 94 req->header.payload_size = sizeof(*req); 95 96 ret = psp_send_platform_access_msg(PSP_CMD_HSTI_QUERY, (struct psp_request *)req); 97 if (ret) 98 goto out; 99 100 if (req->header.status != 0) { 101 dev_dbg(psp->dev, "failed to populate HSTI state: %d\n", req->header.status); 102 ret = -EINVAL; 103 goto out; 104 } 105 106 psp->capability.security_reporting = 1; 107 psp->capability.raw |= req->hsti << PSP_CAPABILITY_PSP_SECURITY_OFFSET; 108 109 out: 110 kfree(req); 111 112 return ret; 113 } 114 115 int psp_init_hsti(struct psp_device *psp) 116 { 117 int ret; 118 119 if (PSP_FEATURE(psp, HSTI)) { 120 ret = psp_populate_hsti(psp); 121 if (ret) 122 return ret; 123 } 124 125 /* 126 * At this stage, if security information hasn't been populated by 127 * either the PSP or by the driver through the platform command, 128 * then there is nothing more to do. 129 */ 130 if (!psp->capability.security_reporting) 131 return 0; 132 133 if (psp->capability.tsme_status) { 134 if (cc_platform_has(CC_ATTR_HOST_MEM_ENCRYPT)) 135 dev_notice(psp->dev, "psp: Both TSME and SME are active, SME is unnecessary when TSME is active.\n"); 136 else 137 dev_notice(psp->dev, "psp: TSME enabled\n"); 138 } 139 140 return 0; 141 } 142