Commit 50c4decc authored by Mario Limonciello's avatar Mario Limonciello Committed by Herbert Xu
Browse files

crypto: ccp - Export PSP security bits to userspace 



The PSP sets several pre-defined bits in the capabilities
register to indicate that security attributes of the platform.

Export these attributes into userspace for administrators to
confirm platform is properly locked down.

Acked-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: default avatarMario Limonciello <mario.limonciello@amd.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent cac32cd4

Documentation/ABI/testing/sysfs-driver-ccp

0 → 100644
+87 −0
Original line number Diff line number Diff line 
What:		/sys/bus/pci/devices/<BDF>/fused_part

Date:		June 2022

KernelVersion:	5.19

Contact:	mario.limonciello@amd.com

Description:

		The /sys/bus/pci/devices/<BDF>/fused_part file reports

		whether the CPU or APU has been fused to prevent tampering.

		0: Not fused

		1: Fused



What:		/sys/bus/pci/devices/<BDF>/debug_lock_on

Date:		June 2022

KernelVersion:	5.19

Contact:	mario.limonciello@amd.com

Description:

		The /sys/bus/pci/devices/<BDF>/debug_lock_on reports

		whether the AMD CPU or APU has been unlocked for debugging.

		Possible values:

		0: Not locked

		1: Locked



What:		/sys/bus/pci/devices/<BDF>/tsme_status

Date:		June 2022

KernelVersion:	5.19

Contact:	mario.limonciello@amd.com

Description:

		The /sys/bus/pci/devices/<BDF>/tsme_status file reports

		the status of transparent secure memory encryption on AMD systems.

		Possible values:

		0: Not active

		1: Active



What:		/sys/bus/pci/devices/<BDF>/anti_rollback_status

Date:		June 2022

KernelVersion:	5.19

Contact:	mario.limonciello@amd.com

Description:

		The /sys/bus/pci/devices/<BDF>/anti_rollback_status file reports

		whether the PSP is enforcing rollback protection.

		Possible values:

		0: Not enforcing

		1: Enforcing



What:		/sys/bus/pci/devices/<BDF>/rpmc_production_enabled

Date:		June 2022

KernelVersion:	5.19

Contact:	mario.limonciello@amd.com

Description:

		The /sys/bus/pci/devices/<BDF>/rpmc_production_enabled file reports

		whether Replay Protected Monotonic Counter support has been enabled.

		Possible values:

		0: Not enabled

		1: Enabled



What:		/sys/bus/pci/devices/<BDF>/rpmc_spirom_available

Date:		June 2022

KernelVersion:	5.19

Contact:	mario.limonciello@amd.com

Description:

		The /sys/bus/pci/devices/<BDF>/rpmc_spirom_available file reports

		whether an Replay Protected Monotonic Counter supported SPI is installed

		on the system.

		Possible values:

		0: Not present

		1: Present



What:		/sys/bus/pci/devices/<BDF>/hsp_tpm_available

Date:		June 2022

KernelVersion:	5.19

Contact:	mario.limonciello@amd.com

Description:

		The /sys/bus/pci/devices/<BDF>/hsp_tpm_available file reports

		whether the HSP TPM has been activated.

		Possible values:

		0: Not activated or present

		1: Activated



What:		/sys/bus/pci/devices/<BDF>/rom_armor_enforced

Date:		June 2022

KernelVersion:	5.19

Contact:	mario.limonciello@amd.com

Description:

		The /sys/bus/pci/devices/<BDF>/rom_armor_enforced file reports

		whether RomArmor SPI protection is enforced.

		Possible values:

		0: Not enforced

		1: Enforced

drivers/crypto/ccp/psp-dev.h

+17 −0
Original line number Diff line number Diff line
@@ -61,5 +61,22 @@ struct psp_device *psp_get_master_device(void); 


#define PSP_CAPABILITY_SEV			BIT(0)

#define PSP_CAPABILITY_TEE			BIT(1)

#define PSP_CAPABILITY_PSP_SECURITY_REPORTING	BIT(7)



#define PSP_CAPABILITY_PSP_SECURITY_OFFSET	8

/*

 * The PSP doesn't directly store these bits in the capability register

 * but instead copies them from the results of query command.

 *

 * The offsets from the query command are below, and shifted when used.

 */

#define PSP_SECURITY_FUSED_PART			BIT(0)

#define PSP_SECURITY_DEBUG_LOCK_ON		BIT(2)

#define PSP_SECURITY_TSME_STATUS		BIT(5)

#define PSP_SECURITY_ANTI_ROLLBACK_STATUS	BIT(7)

#define PSP_SECURITY_RPMC_PRODUCTION_ENABLED	BIT(8)

#define PSP_SECURITY_RPMC_SPIROM_AVAILABLE	BIT(9)

#define PSP_SECURITY_HSP_TPM_AVAILABLE		BIT(10)

#define PSP_SECURITY_ROM_ARMOR_ENFORCED		BIT(11)



#endif /* __PSP_DEV_H */

drivers/crypto/ccp/sp-pci.c

+62 −0
Original line number Diff line number Diff line
@@ -32,6 +32,67 @@ struct sp_pci { 
};

static struct sp_device *sp_dev_master;



#define attribute_show(name, def)						\

static ssize_t name##_show(struct device *d, struct device_attribute *attr,	\

			   char *buf)						\

{										\

	struct sp_device *sp = dev_get_drvdata(d);				\

	struct psp_device *psp = sp->psp_data;					\

	int bit = PSP_SECURITY_##def << PSP_CAPABILITY_PSP_SECURITY_OFFSET;	\

	return sysfs_emit(buf, "%d\n", (psp->capability & bit) > 0);		\

}



attribute_show(fused_part, FUSED_PART)

static DEVICE_ATTR_RO(fused_part);

attribute_show(debug_lock_on, DEBUG_LOCK_ON)

static DEVICE_ATTR_RO(debug_lock_on);

attribute_show(tsme_status, TSME_STATUS)

static DEVICE_ATTR_RO(tsme_status);

attribute_show(anti_rollback_status, ANTI_ROLLBACK_STATUS)

static DEVICE_ATTR_RO(anti_rollback_status);

attribute_show(rpmc_production_enabled, RPMC_PRODUCTION_ENABLED)

static DEVICE_ATTR_RO(rpmc_production_enabled);

attribute_show(rpmc_spirom_available, RPMC_SPIROM_AVAILABLE)

static DEVICE_ATTR_RO(rpmc_spirom_available);

attribute_show(hsp_tpm_available, HSP_TPM_AVAILABLE)

static DEVICE_ATTR_RO(hsp_tpm_available);

attribute_show(rom_armor_enforced, ROM_ARMOR_ENFORCED)

static DEVICE_ATTR_RO(rom_armor_enforced);



static struct attribute *psp_attrs[] = {

	&dev_attr_fused_part.attr,

	&dev_attr_debug_lock_on.attr,

	&dev_attr_tsme_status.attr,

	&dev_attr_anti_rollback_status.attr,

	&dev_attr_rpmc_production_enabled.attr,

	&dev_attr_rpmc_spirom_available.attr,

	&dev_attr_hsp_tpm_available.attr,

	&dev_attr_rom_armor_enforced.attr,

	NULL

};



static umode_t psp_security_is_visible(struct kobject *kobj, struct attribute *attr, int idx)

{

	struct device *dev = kobj_to_dev(kobj);

	struct sp_device *sp = dev_get_drvdata(dev);

	struct psp_device *psp = sp->psp_data;



	if (psp && (psp->capability & PSP_CAPABILITY_PSP_SECURITY_REPORTING))

		return 0444;



	return 0;

}



static struct attribute_group psp_attr_group = {

	.attrs = psp_attrs,

	.is_visible = psp_security_is_visible,

};



static const struct attribute_group *psp_groups[] = {

	&psp_attr_group,

	NULL,

};



static int sp_get_msix_irqs(struct sp_device *sp)

{

	struct sp_pci *sp_pci = sp->dev_specific;
@@ -391,6 +452,7 @@ static struct pci_driver sp_pci_driver = { 
	.remove = sp_pci_remove,

	.shutdown = sp_pci_shutdown,

	.driver.pm = &sp_pci_pm_ops,

	.dev_groups = psp_groups,

};



int sp_pci_init(void)