1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * AMD Secure Processor device driver, security attributes
4 *
5 * Copyright (C) 2023-2024 Advanced Micro Devices, Inc.
6 *
7 * Author: Mario Limonciello <mario.limonciello@amd.com>
8 */
9
10 #include <linux/device.h>
11
12 #include "psp-dev.h"
13 #include "hsti.h"
14
15 #define PSP_CAPABILITY_PSP_SECURITY_OFFSET 8
16
17 struct hsti_request {
18 struct psp_req_buffer_hdr header;
19 u32 hsti;
20 } __packed;
21
22 #define security_attribute_show(name) \
23 static ssize_t name##_show(struct device *d, struct device_attribute *attr, \
24 char *buf) \
25 { \
26 struct sp_device *sp = dev_get_drvdata(d); \
27 struct psp_device *psp = sp->psp_data; \
28 return sysfs_emit(buf, "%d\n", psp->capability.name); \
29 }
30
31 security_attribute_show(fused_part)
32 static DEVICE_ATTR_RO(fused_part);
33 security_attribute_show(boot_integrity)
34 static DEVICE_ATTR_RO(boot_integrity);
35 security_attribute_show(debug_lock_on)
36 static DEVICE_ATTR_RO(debug_lock_on);
37 security_attribute_show(tsme_status)
38 static DEVICE_ATTR_RO(tsme_status);
39 security_attribute_show(anti_rollback_status)
40 static DEVICE_ATTR_RO(anti_rollback_status);
41 security_attribute_show(rpmc_production_enabled)
42 static DEVICE_ATTR_RO(rpmc_production_enabled);
43 security_attribute_show(rpmc_spirom_available)
44 static DEVICE_ATTR_RO(rpmc_spirom_available);
45 security_attribute_show(hsp_tpm_available)
46 static DEVICE_ATTR_RO(hsp_tpm_available);
47 security_attribute_show(rom_armor_enforced)
48 static DEVICE_ATTR_RO(rom_armor_enforced);
49
50 static struct attribute *psp_security_attrs[] = {
51 &dev_attr_fused_part.attr,
52 &dev_attr_boot_integrity.attr,
53 &dev_attr_debug_lock_on.attr,
54 &dev_attr_tsme_status.attr,
55 &dev_attr_anti_rollback_status.attr,
56 &dev_attr_rpmc_production_enabled.attr,
57 &dev_attr_rpmc_spirom_available.attr,
58 &dev_attr_hsp_tpm_available.attr,
59 &dev_attr_rom_armor_enforced.attr,
60 NULL
61 };
62
psp_security_is_visible(struct kobject * kobj,struct attribute * attr,int idx)63 static umode_t psp_security_is_visible(struct kobject *kobj, struct attribute *attr, int idx)
64 {
65 struct device *dev = kobj_to_dev(kobj);
66 struct sp_device *sp = dev_get_drvdata(dev);
67 struct psp_device *psp = sp->psp_data;
68
69 if (psp && psp->capability.security_reporting)
70 return 0444;
71
72 return 0;
73 }
74
75 struct attribute_group psp_security_attr_group = {
76 .attrs = psp_security_attrs,
77 .is_visible = psp_security_is_visible,
78 };
79
psp_populate_hsti(struct psp_device * psp)80 static int psp_populate_hsti(struct psp_device *psp)
81 {
82 struct hsti_request *req;
83 int ret;
84
85 /* Are the security attributes already reported? */
86 if (psp->capability.security_reporting)
87 return 0;
88
89 /* Allocate command-response buffer */
90 req = kzalloc_obj(*req);
91 if (!req)
92 return -ENOMEM;
93
94 req->header.payload_size = sizeof(*req);
95
96 ret = psp_send_platform_access_msg(PSP_CMD_HSTI_QUERY, (struct psp_request *)req);
97 if (ret)
98 goto out;
99
100 if (req->header.status != 0) {
101 dev_dbg(psp->dev, "failed to populate HSTI state: %d\n", req->header.status);
102 ret = -EINVAL;
103 goto out;
104 }
105
106 psp->capability.security_reporting = 1;
107 psp->capability.raw |= req->hsti << PSP_CAPABILITY_PSP_SECURITY_OFFSET;
108
109 out:
110 kfree(req);
111
112 return ret;
113 }
114
psp_init_hsti(struct psp_device * psp)115 int psp_init_hsti(struct psp_device *psp)
116 {
117 int ret;
118
119 if (PSP_FEATURE(psp, HSTI)) {
120 ret = psp_populate_hsti(psp);
121 if (ret)
122 return ret;
123 }
124
125 /*
126 * At this stage, if security information hasn't been populated by
127 * either the PSP or by the driver through the platform command,
128 * then there is nothing more to do.
129 */
130 if (!psp->capability.security_reporting)
131 return 0;
132
133 if (psp->capability.tsme_status) {
134 if (cc_platform_has(CC_ATTR_HOST_MEM_ENCRYPT))
135 dev_notice(psp->dev, "psp: Both TSME and SME are active, SME is unnecessary when TSME is active.\n");
136 else
137 dev_notice(psp->dev, "psp: TSME enabled\n");
138 }
139
140 return 0;
141 }
142