Changes in psp-dev.c

059b1352 - crypto: ccp - Move message about TSME being enabled later in init

Tue, 28 May 2024 21:07:12 +0000

crypto: ccp - Move message about TSME being enabled later in initSome of the security attributes data is now populated from an HSTIcommand on some processors, so show the message after it has beenpopulated.Signed-off-by: Mario Limonciello Acked-by: Tom Lendacky Signed-off-by: Herbert Xu List of files: /linux-6.15/drivers/crypto/ccp/psp-dev.c

82f9327f - crypto: ccp - Add support for getting security attributes on some older systems

Tue, 28 May 2024 21:07:11 +0000

crypto: ccp - Add support for getting security attributes on some older systemsOlder systems will not populate the security attributes in thecapabilities register. The PSP on these systems, however, does have acommand to get the security attributes. Use this command during ccpstartup to populate the attributes if they're missing.Closes: https://github.com/fwupd/fwupd/issues/5284Closes: https://github.com/fwupd/fwupd/issues/5675Closes: https://github.com/fwupd/fwupd/issues/6253Closes: https://github.com/fwupd/fwupd/issues/7280Closes: https://github.com/fwupd/fwupd/issues/6323Closes: https://github.com/fwupd/fwupd/discussions/5433Signed-off-by: Mario Limonciello Acked-by: Tom Lendacky Signed-off-by: Herbert Xu List of files: /linux-6.15/drivers/crypto/ccp/psp-dev.c

56e0d883 - crypto: ccp - Move security attributes to their own file

Tue, 28 May 2024 21:07:09 +0000

crypto: ccp - Move security attributes to their own fileTo prepare for other code that will manipulate security attributesmove the handling code out of sp-pci.c. No intended functional changes.Signed-off-by: Mario Limonciello Acked-by: Tom Lendacky Signed-off-by: Herbert Xu List of files: /linux-6.15/drivers/crypto/ccp/psp-dev.c

8609dd25 - crypto: ccp - Represent capabilities register as a union

Tue, 28 May 2024 21:07:08 +0000

crypto: ccp - Represent capabilities register as a unionMaking the capabilities register a union makes it easier to referto the members instead of always doing bit shifts.No intended functional changes.Acked-by: Tom Lendacky Suggested-by: Yazen Ghannam Signed-off-by: Mario Limonciello Signed-off-by: Herbert Xu List of files: /linux-6.15/drivers/crypto/ccp/psp-dev.c

6e031ef2 - crypto: ccp - State in dmesg that TSME is enabled

Mon, 05 Feb 2024 15:46:01 +0000

crypto: ccp - State in dmesg that TSME is enabledIn the case when only TSME is enabled, it is useful to state that facttoo, so that users are aware that memory encryption is still enabledeven when the corresponding software variant of memory encryption is notenabled.Signed-off-by: Borislav Petkov (AMD) Acked-by: Tom Lendacky Signed-off-by: Herbert Xu List of files: /linux-6.15/drivers/crypto/ccp/psp-dev.c

0470bb1b - crypto: ccp - Add support for DBC over PSP mailbox

Thu, 07 Sep 2023 18:48:46 +0000

crypto: ccp - Add support for DBC over PSP mailboxOn some SOCs DBC is supported through the PSP mailbox instead ofthe platform mailbox. This capability is advertised in the PSPcapabilities register. Allow using this communication path ifsupported.Signed-off-by: Mario Limonciello Signed-off-by: Herbert Xu List of files: /linux-6.15/drivers/crypto/ccp/psp-dev.c

3d5845e1 - crypto: ccp - Add a macro to check capabilities register

Thu, 07 Sep 2023 18:48:45 +0000

crypto: ccp - Add a macro to check capabilities registerOffsets are checked by the capabilities register in multiple places.To make the code more readable add a macro.Signed-off-by: Mario Limonciello Signed-off-by: Herbert Xu List of files: /linux-6.15/drivers/crypto/ccp/psp-dev.c

6e17375c - crypto: ccp - Add support for extended PSP mailbox commands

Thu, 07 Sep 2023 18:48:43 +0000

crypto: ccp - Add support for extended PSP mailbox commandsThe PSP mailbox supports a number of extended sub-commands. Thesesubcommands are placed in the header of the buffer sent to the mailbox.Signed-off-by: Mario Limonciello Signed-off-by: Herbert Xu List of files: /linux-6.15/drivers/crypto/ccp/psp-dev.c

949a0c8d - crypto: ccp - Move direct access to some PSP registers out of TEE

Thu, 07 Sep 2023 18:48:42 +0000

crypto: ccp - Move direct access to some PSP registers out of TEEWith the PSP mailbox registers supporting more than just TEE, access tothem must be maintained and serialized by the PSP device support. RemoveTEE support direct access and create an interface in the PSP supportwhere the register access can be controlled/serialized.Signed-off-by: Tom Lendacky Signed-off-by: Mario Limonciello Reviewed-by: Rijo Thomas Tested-by: Rijo Thomas Signed-off-by: Herbert Xu List of files: /linux-6.15/drivers/crypto/ccp/psp-dev.c

c04cf9e1 - crypto: ccp - Add support for fetching a nonce for dynamic boost control

Fri, 23 Jun 2023 13:49:55 +0000

crypto: ccp - Add support for fetching a nonce for dynamic boost controlDynamic Boost Control is a feature offered on AMD client platforms thatallows software to request and set power or frequency limits.Only software that has authenticated with the PSP can retrieve or setthese limits.Create a character device and ioctl for fetching the nonce. This ioctlsupports optionally passing authentication information which will influencehow many calls the nonce is valid for.Acked-by: Tom Lendacky Signed-off-by: Mario Limonciello Signed-off-by: Herbert Xu List of files: /linux-6.15/drivers/crypto/ccp/psp-dev.c

b8440d55 - crypto: ccp - move setting PSP master to earlier in the init

Fri, 23 Jun 2023 13:49:54 +0000

crypto: ccp - move setting PSP master to earlier in the initDynamic boost control needs to use platform access symbolsthat look for the PSP master as part of initialization.So move the PSP master before psp_init() so that dynamic boostcontrol can be initialized properly.Acked-by: Tom Lendacky Signed-off-by: Mario Limonciello Signed-off-by: Herbert Xu List of files: /linux-6.15/drivers/crypto/ccp/psp-dev.c

45121ad4 - crypto: ccp - Clear PSP interrupt status register before calling handler

Tue, 28 Mar 2023 15:16:36 +0000

crypto: ccp - Clear PSP interrupt status register before calling handlerThe PSP IRQ is edge-triggered (MSI or MSI-X) in all cases supported bythe psp module so clear the interrupt status register early in thehandler to prevent missed interrupts. sev_irq_handler() calls wake_up()on a wait queue, which can result in a new command being submitted froma different CPU. This then races with the clearing of isr and can resultin missed interrupts. A missed interrupt results in a command waitinguntil it times out, which results in the psp being declared dead.This is unlikely on bare metal, but has been observed when runningvirtualized. In the cases where this is observed, sev->cmdresp_reg hasPSP_CMDRESP_RESP set which indicates that the command was processedcorrectly but no interrupt was asserted.The full sequence of events looks like this:CPU 1: submits SEV cmd #1CPU 1: calls wait_event_timeout()CPU 0: enters psp_irq_handler()CPU 0: calls sev_handler()->wake_up()CPU 1: wakes up; finishes processing cmd #1CPU 1: submits SEV cmd #2CPU 1: calls wait_event_timeout()PSP: finishes processing cmd #2; interrupt status is still set; no interruptCPU 0: clears intstsCPU 0: exits psp_irq_handler()CPU 1: wait_event_timeout() times out; psp_dead=trueFixes: 200664d5237f ("crypto: ccp: Add Secure Encrypted Virtualization (SEV) command support")Cc: stable@vger.kernel.orgSigned-off-by: Jeremi Piotrowski Acked-by: Tom Lendacky Signed-off-by: Herbert Xu List of files: /linux-6.15/drivers/crypto/ccp/psp-dev.c

7ccc4f4e - crypto: ccp - Add support for an interface for platform features

Fri, 10 Mar 2023 21:19:47 +0000

crypto: ccp - Add support for an interface for platform featuresSome platforms with a PSP support an interface for features thatinteract directly with the PSP instead of through a SEV or TEEenvironment.Initialize this interface so that other drivers can consume it.These drivers may either be subdrivers for the ccp module orexternal modules. For external modules, export a symbol for themto utilize.Acked-by: Tom Lendacky Signed-off-by: Mario Limonciello Signed-off-by: Herbert Xu List of files: /linux-6.15/drivers/crypto/ccp/psp-dev.c

a7ca7bbd - crypto: ccp - Drop TEE support for IRQ handler

Fri, 10 Mar 2023 21:19:44 +0000

crypto: ccp - Drop TEE support for IRQ handlerThe only PSP mailbox that currently supports interrupt on completionis the SEV mailbox. Drop the dead code for the TEE subdriver topotentially call it.Acked-by: Rijo Thomas Acked-by: Tom Lendacky Signed-off-by: Mario Limonciello Signed-off-by: Herbert Xu List of files: /linux-6.15/drivers/crypto/ccp/psp-dev.c

4e2c8794 - crypto: ccp - When TSME and SME both detected notify user

Thu, 31 Mar 2022 21:12:13 +0000

crypto: ccp - When TSME and SME both detected notify userCC_ATTR_HOST_MEM_ENCRYPT is used to relay that memory encryption has beenactivated by the kernel.As it's technically possible to enable both SME and TSME at the same time,detect this scenario and notify the user that enabling TSME and SME at thesame time is unnecessary.Signed-off-by: Mario Limonciello Acked-by: Tom Lendacky Signed-off-by: Herbert Xu List of files: /linux-6.15/drivers/crypto/ccp/psp-dev.c

84ee393b - crypto: ccp - Allow PSP driver to load without SEV/TEE support

Thu, 31 Mar 2022 21:12:12 +0000

crypto: ccp - Allow PSP driver to load without SEV/TEE supportPreviously the PSP probe routine would fail if both SEV and TEE weremissing. This is possibly the case for some client parts.As capabilities can now be accessed from userspace, it may still beuseful to have the PSP driver finish loading so that those capabilitiescan be read.Signed-off-by: Mario Limonciello Acked-by: Tom Lendacky Signed-off-by: Herbert Xu List of files: /linux-6.15/drivers/crypto/ccp/psp-dev.c

cac32cd4 - crypto: ccp - cache capability into psp device

Thu, 31 Mar 2022 21:12:10 +0000

crypto: ccp - cache capability into psp deviceThe results of the capability register will be used by futurecode at runtime rather than just initialization.Acked-by: Tom Lendacky Signed-off-by: Mario Limonciello Signed-off-by: Herbert Xu List of files: /linux-6.15/drivers/crypto/ccp/psp-dev.c

15f7a4c6 - crypto: ccp - Cleanup sp_dev_master in psp_dev_destroy()

Tue, 03 Mar 2020 13:57:24 +0000

crypto: ccp - Cleanup sp_dev_master in psp_dev_destroy()Introduce clear_psp_master_device() to ensure that sp_dev_master getsproperly cleared on the release of a psp device.Fixes: 2a6170dfe755 ("crypto: ccp: Add Platform Security Processor (PSP) device support")Signed-off-by: John Allen Acked-by: Tom Lendacky Signed-off-by: Herbert Xu List of files: /linux-6.15/drivers/crypto/ccp/psp-dev.c

33960acc - crypto: ccp - add TEE support for Raven Ridge

Wed, 04 Dec 2019 06:19:02 +0000

crypto: ccp - add TEE support for Raven RidgeAdds a PCI device entry for Raven Ridge. Raven Ridge is an APU with adedicated AMD Secure Processor having Trusted Execution Environment (TEE)support. The TEE provides a secure environment for running TrustedApplications (TAs) which implement security-sensitive parts of a feature.This patch configures AMD Secure Processor's TEE interface by initializinga ring buffer (shared memory between Rich OS and Trusted OS) which can holdmultiple command buffer entries. The TEE interface is facilitated by a setof CPU to PSP mailbox registers.The next patch will address how commands are submitted to the ring buffer.Cc: Jens Wiklander Cc: Tom Lendacky Cc: Ard Biesheuvel Co-developed-by: Devaraj Rangasamy Signed-off-by: Devaraj Rangasamy Signed-off-by: Rijo Thomas Acked-by: Gary R Hook Signed-off-by: Herbert Xu List of files: /linux-6.15/drivers/crypto/ccp/psp-dev.c

f100ab62 - crypto: ccp - check whether PSP supports SEV or TEE before initialization

Wed, 04 Dec 2019 06:19:01 +0000

crypto: ccp - check whether PSP supports SEV or TEE before initializationRead PSP feature register to check for TEE (Trusted Execution Environment)support.If neither SEV nor TEE is supported by PSP, then skip PSP initialization.Cc: Tom Lendacky Cc: Jens Wiklander Cc: Ard Biesheuvel Co-developed-by: Devaraj Rangasamy Signed-off-by: Devaraj Rangasamy Signed-off-by: Rijo Thomas Acked-by: Gary R Hook Signed-off-by: Herbert Xu List of files: /linux-6.15/drivers/crypto/ccp/psp-dev.c