crypto: ccp - Move message about TSME being enabled later in init

Some of the security attributes data is now populated from an HSTI
command on some processors, so show the message after it has been

crypto: ccp - Move message about TSME being enabled later in init

Some of the security attributes data is now populated from an HSTI
command on some processors, so show the message after it has been
populated.

Signed-off-by: Mario Limonciello <[email protected]>
Acked-by: Tom Lendacky <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

show more ...

crypto: ccp - Add support for getting security attributes on some older systems

Older systems will not populate the security attributes in the
capabilities register. The PSP on these systems, howeve

crypto: ccp - Add support for getting security attributes on some older systems

Older systems will not populate the security attributes in the
capabilities register. The PSP on these systems, however, does have a
command to get the security attributes. Use this command during ccp
startup to populate the attributes if they're missing.

Closes: https://github.com/fwupd/fwupd/issues/5284
Closes: https://github.com/fwupd/fwupd/issues/5675
Closes: https://github.com/fwupd/fwupd/issues/6253
Closes: https://github.com/fwupd/fwupd/issues/7280
Closes: https://github.com/fwupd/fwupd/issues/6323
Closes: https://github.com/fwupd/fwupd/discussions/5433
Signed-off-by: Mario Limonciello <[email protected]>
Acked-by: Tom Lendacky <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

show more ...

crypto: ccp - Move security attributes to their own file

To prepare for other code that will manipulate security attributes
move the handling code out of sp-pci.c. No intended functional changes.

S

crypto: ccp - Move security attributes to their own file

To prepare for other code that will manipulate security attributes
move the handling code out of sp-pci.c. No intended functional changes.

Signed-off-by: Mario Limonciello <[email protected]>
Acked-by: Tom Lendacky <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

show more ...

crypto: ccp - Represent capabilities register as a union

Making the capabilities register a union makes it easier to refer
to the members instead of always doing bit shifts.

No intended functional

crypto: ccp - Represent capabilities register as a union

Making the capabilities register a union makes it easier to refer
to the members instead of always doing bit shifts.

No intended functional changes.

Acked-by: Tom Lendacky <[email protected]>
Suggested-by: Yazen Ghannam <[email protected]>
Signed-off-by: Mario Limonciello <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

show more ...

crypto: ccp - State in dmesg that TSME is enabled

In the case when only TSME is enabled, it is useful to state that fact
too, so that users are aware that memory encryption is still enabled
even whe

crypto: ccp - State in dmesg that TSME is enabled

In the case when only TSME is enabled, it is useful to state that fact
too, so that users are aware that memory encryption is still enabled
even when the corresponding software variant of memory encryption is not
enabled.

Signed-off-by: Borislav Petkov (AMD) <[email protected]>
Acked-by: Tom Lendacky <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

show more ...

crypto: ccp - Add support for DBC over PSP mailbox

On some SOCs DBC is supported through the PSP mailbox instead of
the platform mailbox. This capability is advertised in the PSP
capabilities regist

crypto: ccp - Add support for DBC over PSP mailbox

On some SOCs DBC is supported through the PSP mailbox instead of
the platform mailbox. This capability is advertised in the PSP
capabilities register. Allow using this communication path if
supported.

Signed-off-by: Mario Limonciello <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

show more ...

crypto: ccp - Add a macro to check capabilities register

Offsets are checked by the capabilities register in multiple places.
To make the code more readable add a macro.

Signed-off-by: Mario Limonc

crypto: ccp - Add a macro to check capabilities register

Offsets are checked by the capabilities register in multiple places.
To make the code more readable add a macro.

Signed-off-by: Mario Limonciello <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

show more ...

crypto: ccp - Add support for extended PSP mailbox commands

The PSP mailbox supports a number of extended sub-commands. These
subcommands are placed in the header of the buffer sent to the mailbox.

crypto: ccp - Add support for extended PSP mailbox commands

The PSP mailbox supports a number of extended sub-commands. These
subcommands are placed in the header of the buffer sent to the mailbox.

Signed-off-by: Mario Limonciello <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

show more ...

crypto: ccp - Move direct access to some PSP registers out of TEE

With the PSP mailbox registers supporting more than just TEE, access to
them must be maintained and serialized by the PSP device sup

crypto: ccp - Move direct access to some PSP registers out of TEE

With the PSP mailbox registers supporting more than just TEE, access to
them must be maintained and serialized by the PSP device support. Remove
TEE support direct access and create an interface in the PSP support
where the register access can be controlled/serialized.

Signed-off-by: Tom Lendacky <[email protected]>
Signed-off-by: Mario Limonciello <[email protected]>
Reviewed-by: Rijo Thomas <[email protected]>
Tested-by: Rijo Thomas <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

show more ...

crypto: ccp - Add support for fetching a nonce for dynamic boost control

Dynamic Boost Control is a feature offered on AMD client platforms that
allows software to request and set power or frequency

crypto: ccp - Add support for fetching a nonce for dynamic boost control

Dynamic Boost Control is a feature offered on AMD client platforms that
allows software to request and set power or frequency limits.

Only software that has authenticated with the PSP can retrieve or set
these limits.

Create a character device and ioctl for fetching the nonce. This ioctl
supports optionally passing authentication information which will influence
how many calls the nonce is valid for.

Acked-by: Tom Lendacky <[email protected]>
Signed-off-by: Mario Limonciello <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

show more ...

crypto: ccp - move setting PSP master to earlier in the init

Dynamic boost control needs to use platform access symbols
that look for the PSP master as part of initialization.

So move the PSP maste

crypto: ccp - move setting PSP master to earlier in the init

Dynamic boost control needs to use platform access symbols
that look for the PSP master as part of initialization.

So move the PSP master before psp_init() so that dynamic boost
control can be initialized properly.

Acked-by: Tom Lendacky <[email protected]>
Signed-off-by: Mario Limonciello <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

show more ...

crypto: ccp - Clear PSP interrupt status register before calling handler

The PSP IRQ is edge-triggered (MSI or MSI-X) in all cases supported by
the psp module so clear the interrupt status register

crypto: ccp - Clear PSP interrupt status register before calling handler

The PSP IRQ is edge-triggered (MSI or MSI-X) in all cases supported by
the psp module so clear the interrupt status register early in the
handler to prevent missed interrupts. sev_irq_handler() calls wake_up()
on a wait queue, which can result in a new command being submitted from
a different CPU. This then races with the clearing of isr and can result
in missed interrupts. A missed interrupt results in a command waiting
until it times out, which results in the psp being declared dead.

This is unlikely on bare metal, but has been observed when running
virtualized. In the cases where this is observed, sev->cmdresp_reg has
PSP_CMDRESP_RESP set which indicates that the command was processed
correctly but no interrupt was asserted.

The full sequence of events looks like this:

CPU 1: submits SEV cmd #1
CPU 1: calls wait_event_timeout()
CPU 0: enters psp_irq_handler()
CPU 0: calls sev_handler()->wake_up()
CPU 1: wakes up; finishes processing cmd #1
CPU 1: submits SEV cmd #2
CPU 1: calls wait_event_timeout()
PSP: finishes processing cmd #2; interrupt status is still set; no interrupt
CPU 0: clears intsts
CPU 0: exits psp_irq_handler()
CPU 1: wait_event_timeout() times out; psp_dead=true

Fixes: 200664d5237f ("crypto: ccp: Add Secure Encrypted Virtualization (SEV) command support")
Cc: [email protected]
Signed-off-by: Jeremi Piotrowski <[email protected]>
Acked-by: Tom Lendacky <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

show more ...

crypto: ccp - Add support for an interface for platform features

Some platforms with a PSP support an interface for features that
interact directly with the PSP instead of through a SEV or TEE
envir

crypto: ccp - Add support for an interface for platform features

Some platforms with a PSP support an interface for features that
interact directly with the PSP instead of through a SEV or TEE
environment.

Initialize this interface so that other drivers can consume it.
These drivers may either be subdrivers for the ccp module or
external modules. For external modules, export a symbol for them
to utilize.

Acked-by: Tom Lendacky <[email protected]>
Signed-off-by: Mario Limonciello <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

show more ...

crypto: ccp - Drop TEE support for IRQ handler

The only PSP mailbox that currently supports interrupt on completion
is the SEV mailbox. Drop the dead code for the TEE subdriver to
potentially call

crypto: ccp - Drop TEE support for IRQ handler

The only PSP mailbox that currently supports interrupt on completion
is the SEV mailbox. Drop the dead code for the TEE subdriver to
potentially call it.

Acked-by: Rijo Thomas <[email protected]>
Acked-by: Tom Lendacky <[email protected]>
Signed-off-by: Mario Limonciello <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

show more ...

crypto: ccp - When TSME and SME both detected notify user

CC_ATTR_HOST_MEM_ENCRYPT is used to relay that memory encryption has been
activated by the kernel.

As it's technically possible to enable b

crypto: ccp - When TSME and SME both detected notify user

CC_ATTR_HOST_MEM_ENCRYPT is used to relay that memory encryption has been
activated by the kernel.

As it's technically possible to enable both SME and TSME at the same time,
detect this scenario and notify the user that enabling TSME and SME at the
same time is unnecessary.

Signed-off-by: Mario Limonciello <[email protected]>
Acked-by: Tom Lendacky <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

show more ...

crypto: ccp - Allow PSP driver to load without SEV/TEE support

Previously the PSP probe routine would fail if both SEV and TEE were
missing. This is possibly the case for some client parts.

As cap

crypto: ccp - Allow PSP driver to load without SEV/TEE support

Previously the PSP probe routine would fail if both SEV and TEE were
missing. This is possibly the case for some client parts.

As capabilities can now be accessed from userspace, it may still be
useful to have the PSP driver finish loading so that those capabilities
can be read.

Signed-off-by: Mario Limonciello <[email protected]>
Acked-by: Tom Lendacky <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

show more ...

crypto: ccp - cache capability into psp device

The results of the capability register will be used by future
code at runtime rather than just initialization.

Acked-by: Tom Lendacky <thomas.lendacky

crypto: ccp - cache capability into psp device

The results of the capability register will be used by future
code at runtime rather than just initialization.

Acked-by: Tom Lendacky <[email protected]>
Signed-off-by: Mario Limonciello <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

show more ...

crypto: ccp - Cleanup sp_dev_master in psp_dev_destroy()

Introduce clear_psp_master_device() to ensure that sp_dev_master gets
properly cleared on the release of a psp device.

Fixes: 2a6170dfe755 (

crypto: ccp - Cleanup sp_dev_master in psp_dev_destroy()

Introduce clear_psp_master_device() to ensure that sp_dev_master gets
properly cleared on the release of a psp device.

Fixes: 2a6170dfe755 ("crypto: ccp: Add Platform Security Processor (PSP) device support")
Signed-off-by: John Allen <[email protected]>
Acked-by: Tom Lendacky <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

show more ...

crypto: ccp - add TEE support for Raven Ridge

Adds a PCI device entry for Raven Ridge. Raven Ridge is an APU with a
dedicated AMD Secure Processor having Trusted Execution Environment (TEE)
support.

crypto: ccp - add TEE support for Raven Ridge

Adds a PCI device entry for Raven Ridge. Raven Ridge is an APU with a
dedicated AMD Secure Processor having Trusted Execution Environment (TEE)
support. The TEE provides a secure environment for running Trusted
Applications (TAs) which implement security-sensitive parts of a feature.

This patch configures AMD Secure Processor's TEE interface by initializing
a ring buffer (shared memory between Rich OS and Trusted OS) which can hold
multiple command buffer entries. The TEE interface is facilitated by a set
of CPU to PSP mailbox registers.

The next patch will address how commands are submitted to the ring buffer.

Cc: Jens Wiklander <[email protected]>
Cc: Tom Lendacky <[email protected]>
Cc: Ard Biesheuvel <[email protected]>
Co-developed-by: Devaraj Rangasamy <[email protected]>
Signed-off-by: Devaraj Rangasamy <[email protected]>
Signed-off-by: Rijo Thomas <[email protected]>
Acked-by: Gary R Hook <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

show more ...

crypto: ccp - check whether PSP supports SEV or TEE before initialization

Read PSP feature register to check for TEE (Trusted Execution Environment)
support.

If neither SEV nor TEE is supported by

crypto: ccp - check whether PSP supports SEV or TEE before initialization

Read PSP feature register to check for TEE (Trusted Execution Environment)
support.

If neither SEV nor TEE is supported by PSP, then skip PSP initialization.

Cc: Tom Lendacky <[email protected]>
Cc: Jens Wiklander <[email protected]>
Cc: Ard Biesheuvel <[email protected]>
Co-developed-by: Devaraj Rangasamy <[email protected]>
Signed-off-by: Devaraj Rangasamy <[email protected]>
Signed-off-by: Rijo Thomas <[email protected]>
Acked-by: Gary R Hook <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

show more ...

crypto: ccp - create a generic psp-dev file

The PSP (Platform Security Processor) provides support for key management
commands in Secure Encrypted Virtualization (SEV) mode, along with
software-base

crypto: ccp - create a generic psp-dev file

The PSP (Platform Security Processor) provides support for key management
commands in Secure Encrypted Virtualization (SEV) mode, along with
software-based Trusted Execution Environment (TEE) to enable third-party
Trusted Applications.

Therefore, introduce psp-dev.c and psp-dev.h files, which can invoke
SEV (or TEE) initialization based on platform feature support.

TEE interface support will be introduced in a later patch.

Cc: Ard Biesheuvel <[email protected]>
Cc: Tom Lendacky <[email protected]>
Cc: Jens Wiklander <[email protected]>
Co-developed-by: Devaraj Rangasamy <[email protected]>
Signed-off-by: Devaraj Rangasamy <[email protected]>
Signed-off-by: Rijo Thomas <[email protected]>
Acked-by: Gary R Hook <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

show more ...

crypto: ccp - add SEV command privilege separation

Currently, there is no privilege separation of the SEV command; you can
run them all or none of them. This is less than ideal because it means
that

crypto: ccp - add SEV command privilege separation

Currently, there is no privilege separation of the SEV command; you can
run them all or none of them. This is less than ideal because it means
that a compromise of the code which launches VMs could make permanent
change to the SEV certifcate chain which will affect others.

These commands are required to attest the VM environment:
- SEV_PDH_CERT_EXPORT
- SEV_PLATFORM_STATUS
- SEV_GET_{ID,ID2}

These commands manage the SEV certificate chain:
- SEV_PEK_CERR_IMPORT
- SEV_FACTORY_RESET
- SEV_PEK_GEN
- SEV_PEK_CSR
- SEV_PDH_GEN

Lets add the CAP_SYS_ADMIN check for the group of the commands which alters
the SEV certificate chain to provide some level of privilege separation.

Cc: Herbert Xu <[email protected]>
Cc: Gary Hook <[email protected]>
Cc: Erdem Aktas <[email protected]>
Cc: Tom Lendacky <[email protected]>
Tested-by: David Rientjes <[email protected]>
Co-developed-by: David Rientjes <[email protected]>
Signed-off-by: David Rientjes <[email protected]>
Signed-off-by: Brijesh Singh <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

show more ...

crypto: ccp - Verify access to device registers before initializing

Check early whether device registers can be accessed. Some BIOSes have
a broken security policy that prevents access to the device

crypto: ccp - Verify access to device registers before initializing

Check early whether device registers can be accessed. Some BIOSes have
a broken security policy that prevents access to the device registers,
and return values from ioread() can be misinterpreted. If a read of
a feature register returns a -1, we may not be able to access
any device register, so report the problem and suggestion, and return.

For the PSP, the feature register is checked. For the CCP, the queue
register is checked.

Signed-off-by: Gary R Hook <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

show more ...

crypto: ccp - Retry SEV INIT command in case of integrity check failure.

SEV INIT command loads the SEV related persistent data from NVS
and initializes the platform context. The firmware validates

crypto: ccp - Retry SEV INIT command in case of integrity check failure.

SEV INIT command loads the SEV related persistent data from NVS
and initializes the platform context. The firmware validates the
persistent state. If validation fails, the firmware will reset
the persisent state and return an integrity check failure status.

At this point, a subsequent INIT command should succeed, so retry
the command. The INIT command retry is only done during driver
initialization.

Additional enums along with SEV_RET_SECURE_DATA_INVALID are added
to sev_ret_code to maintain continuity and relevance of enum values.

Signed-off-by: Ashish Kalra <[email protected]>
Acked-by: David Rientjes <[email protected]>
Reviewed-by: Brijesh Singh <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

show more ...

KVM: SVM: Remove unneeded WBINVD and DF_FLUSH when starting SEV guests

Performing a WBINVD and DF_FLUSH are expensive operations. The SEV support
currently performs this WBINVD/DF_FLUSH combination

KVM: SVM: Remove unneeded WBINVD and DF_FLUSH when starting SEV guests

Performing a WBINVD and DF_FLUSH are expensive operations. The SEV support
currently performs this WBINVD/DF_FLUSH combination when an SEV guest is
terminated, so there is no need for it to be done before LAUNCH.

However, when the SEV firmware transitions the platform from UNINIT state
to INIT state, all ASIDs will be marked invalid across all threads.
Therefore, as part of transitioning the platform to INIT state, perform a
WBINVD/DF_FLUSH after a successful INIT in the PSP/SEV device driver.
Since the PSP/SEV device driver is x86 only, it can reference and use the
WBINVD related functions directly.

Cc: Gary Hook <[email protected]>
Cc: Herbert Xu <[email protected]>
Cc: "David S. Miller" <[email protected]>
Tested-by: David Rientjes <[email protected]>
Signed-off-by: Tom Lendacky <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>

show more ...