forked from Minki/linux
crypto: ccp - Export PSP security bits to userspace
The PSP sets several pre-defined bits in the capabilities register to indicate that security attributes of the platform. Export these attributes into userspace for administrators to confirm platform is properly locked down. Acked-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
Mario Limonciello
Herbert Xu
parent
cac32cd4f1
commit
50c4decc1b
87
Documentation/ABI/testing/sysfs-driver-ccp
Normal file
87
Documentation/ABI/testing/sysfs-driver-ccp
Normal file
@ -0,0 +1,87 @@
|
||||
What: /sys/bus/pci/devices/<BDF>/fused_part
|
||||
Date: June 2022
|
||||
KernelVersion: 5.19
|
||||
Contact: mario.limonciello@amd.com
|
||||
Description:
|
||||
The /sys/bus/pci/devices/<BDF>/fused_part file reports
|
||||
whether the CPU or APU has been fused to prevent tampering.
|
||||
0: Not fused
|
||||
1: Fused
|
||||
|
||||
What: /sys/bus/pci/devices/<BDF>/debug_lock_on
|
||||
Date: June 2022
|
||||
KernelVersion: 5.19
|
||||
Contact: mario.limonciello@amd.com
|
||||
Description:
|
||||
The /sys/bus/pci/devices/<BDF>/debug_lock_on reports
|
||||
whether the AMD CPU or APU has been unlocked for debugging.
|
||||
Possible values:
|
||||
0: Not locked
|
||||
1: Locked
|
||||
|
||||
What: /sys/bus/pci/devices/<BDF>/tsme_status
|
||||
Date: June 2022
|
||||
KernelVersion: 5.19
|
||||
Contact: mario.limonciello@amd.com
|
||||
Description:
|
||||
The /sys/bus/pci/devices/<BDF>/tsme_status file reports
|
||||
the status of transparent secure memory encryption on AMD systems.
|
||||
Possible values:
|
||||
0: Not active
|
||||
1: Active
|
||||
|
||||
What: /sys/bus/pci/devices/<BDF>/anti_rollback_status
|
||||
Date: June 2022
|
||||
KernelVersion: 5.19
|
||||
Contact: mario.limonciello@amd.com
|
||||
Description:
|
||||
The /sys/bus/pci/devices/<BDF>/anti_rollback_status file reports
|
||||
whether the PSP is enforcing rollback protection.
|
||||
Possible values:
|
||||
0: Not enforcing
|
||||
1: Enforcing
|
||||
|
||||
What: /sys/bus/pci/devices/<BDF>/rpmc_production_enabled
|
||||
Date: June 2022
|
||||
KernelVersion: 5.19
|
||||
Contact: mario.limonciello@amd.com
|
||||
Description:
|
||||
The /sys/bus/pci/devices/<BDF>/rpmc_production_enabled file reports
|
||||
whether Replay Protected Monotonic Counter support has been enabled.
|
||||
Possible values:
|
||||
0: Not enabled
|
||||
1: Enabled
|
||||
|
||||
What: /sys/bus/pci/devices/<BDF>/rpmc_spirom_available
|
||||
Date: June 2022
|
||||
KernelVersion: 5.19
|
||||
Contact: mario.limonciello@amd.com
|
||||
Description:
|
||||
The /sys/bus/pci/devices/<BDF>/rpmc_spirom_available file reports
|
||||
whether an Replay Protected Monotonic Counter supported SPI is installed
|
||||
on the system.
|
||||
Possible values:
|
||||
0: Not present
|
||||
1: Present
|
||||
|
||||
What: /sys/bus/pci/devices/<BDF>/hsp_tpm_available
|
||||
Date: June 2022
|
||||
KernelVersion: 5.19
|
||||
Contact: mario.limonciello@amd.com
|
||||
Description:
|
||||
The /sys/bus/pci/devices/<BDF>/hsp_tpm_available file reports
|
||||
whether the HSP TPM has been activated.
|
||||
Possible values:
|
||||
0: Not activated or present
|
||||
1: Activated
|
||||
|
||||
What: /sys/bus/pci/devices/<BDF>/rom_armor_enforced
|
||||
Date: June 2022
|
||||
KernelVersion: 5.19
|
||||
Contact: mario.limonciello@amd.com
|
||||
Description:
|
||||
The /sys/bus/pci/devices/<BDF>/rom_armor_enforced file reports
|
||||
whether RomArmor SPI protection is enforced.
|
||||
Possible values:
|
||||
0: Not enforced
|
||||
1: Enforced
|
||||
@ -61,5 +61,22 @@ struct psp_device *psp_get_master_device(void);
|
||||
|
||||
#define PSP_CAPABILITY_SEV BIT(0)
|
||||
#define PSP_CAPABILITY_TEE BIT(1)
|
||||
#define PSP_CAPABILITY_PSP_SECURITY_REPORTING BIT(7)
|
||||
|
||||
#define PSP_CAPABILITY_PSP_SECURITY_OFFSET 8
|
||||
/*
|
||||
* The PSP doesn't directly store these bits in the capability register
|
||||
* but instead copies them from the results of query command.
|
||||
*
|
||||
* The offsets from the query command are below, and shifted when used.
|
||||
*/
|
||||
#define PSP_SECURITY_FUSED_PART BIT(0)
|
||||
#define PSP_SECURITY_DEBUG_LOCK_ON BIT(2)
|
||||
#define PSP_SECURITY_TSME_STATUS BIT(5)
|
||||
#define PSP_SECURITY_ANTI_ROLLBACK_STATUS BIT(7)
|
||||
#define PSP_SECURITY_RPMC_PRODUCTION_ENABLED BIT(8)
|
||||
#define PSP_SECURITY_RPMC_SPIROM_AVAILABLE BIT(9)
|
||||
#define PSP_SECURITY_HSP_TPM_AVAILABLE BIT(10)
|
||||
#define PSP_SECURITY_ROM_ARMOR_ENFORCED BIT(11)
|
||||
|
||||
#endif /* __PSP_DEV_H */
|
||||
|
||||
@ -32,6 +32,67 @@ struct sp_pci {
|
||||
};
|
||||
static struct sp_device *sp_dev_master;
|
||||
|
||||
#define attribute_show(name, def) \
|
||||
static ssize_t name##_show(struct device *d, struct device_attribute *attr, \
|
||||
char *buf) \
|
||||
{ \
|
||||
struct sp_device *sp = dev_get_drvdata(d); \
|
||||
struct psp_device *psp = sp->psp_data; \
|
||||
int bit = PSP_SECURITY_##def << PSP_CAPABILITY_PSP_SECURITY_OFFSET; \
|
||||
return sysfs_emit(buf, "%d\n", (psp->capability & bit) > 0); \
|
||||
}
|
||||
|
||||
attribute_show(fused_part, FUSED_PART)
|
||||
static DEVICE_ATTR_RO(fused_part);
|
||||
attribute_show(debug_lock_on, DEBUG_LOCK_ON)
|
||||
static DEVICE_ATTR_RO(debug_lock_on);
|
||||
attribute_show(tsme_status, TSME_STATUS)
|
||||
static DEVICE_ATTR_RO(tsme_status);
|
||||
attribute_show(anti_rollback_status, ANTI_ROLLBACK_STATUS)
|
||||
static DEVICE_ATTR_RO(anti_rollback_status);
|
||||
attribute_show(rpmc_production_enabled, RPMC_PRODUCTION_ENABLED)
|
||||
static DEVICE_ATTR_RO(rpmc_production_enabled);
|
||||
attribute_show(rpmc_spirom_available, RPMC_SPIROM_AVAILABLE)
|
||||
static DEVICE_ATTR_RO(rpmc_spirom_available);
|
||||
attribute_show(hsp_tpm_available, HSP_TPM_AVAILABLE)
|
||||
static DEVICE_ATTR_RO(hsp_tpm_available);
|
||||
attribute_show(rom_armor_enforced, ROM_ARMOR_ENFORCED)
|
||||
static DEVICE_ATTR_RO(rom_armor_enforced);
|
||||
|
||||
static struct attribute *psp_attrs[] = {
|
||||
&dev_attr_fused_part.attr,
|
||||
&dev_attr_debug_lock_on.attr,
|
||||
&dev_attr_tsme_status.attr,
|
||||
&dev_attr_anti_rollback_status.attr,
|
||||
&dev_attr_rpmc_production_enabled.attr,
|
||||
&dev_attr_rpmc_spirom_available.attr,
|
||||
&dev_attr_hsp_tpm_available.attr,
|
||||
&dev_attr_rom_armor_enforced.attr,
|
||||
NULL
|
||||
};
|
||||
|
||||
static umode_t psp_security_is_visible(struct kobject *kobj, struct attribute *attr, int idx)
|
||||
{
|
||||
struct device *dev = kobj_to_dev(kobj);
|
||||
struct sp_device *sp = dev_get_drvdata(dev);
|
||||
struct psp_device *psp = sp->psp_data;
|
||||
|
||||
if (psp && (psp->capability & PSP_CAPABILITY_PSP_SECURITY_REPORTING))
|
||||
return 0444;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static struct attribute_group psp_attr_group = {
|
||||
.attrs = psp_attrs,
|
||||
.is_visible = psp_security_is_visible,
|
||||
};
|
||||
|
||||
static const struct attribute_group *psp_groups[] = {
|
||||
&psp_attr_group,
|
||||
NULL,
|
||||
};
|
||||
|
||||
static int sp_get_msix_irqs(struct sp_device *sp)
|
||||
{
|
||||
struct sp_pci *sp_pci = sp->dev_specific;
|
||||
@ -391,6 +452,7 @@ static struct pci_driver sp_pci_driver = {
|
||||
.remove = sp_pci_remove,
|
||||
.shutdown = sp_pci_shutdown,
|
||||
.driver.pm = &sp_pci_pm_ops,
|
||||
.dev_groups = psp_groups,
|
||||
};
|
||||
|
||||
int sp_pci_init(void)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user