linux-kernel - [PATCH v2 0/4] Only export SME/SEV/SEV

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 11 Feb 2022 15:02:51 -0600
From:   Mario Limonciello <mario.limonciello@....com>
To:     Borislav Petkov <bp@...en8.de>,
        "maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT)" <x86@...nel.org>
CC:     Kees Cook <keescook@...omium.org>,
        Thomas Lendacky <Thomas.Lendacky@....com>,
        <hughsient@...il.com>,
        Martin Fernandez <martin.fernandez@...ypsium.com>,
        <linux-kernel@...r.kernel.org>,
        "Brijesh Singh" <brijesh.singh@....com>,
        Mario Limonciello <mario.limonciello@....com>
Subject: [PATCH v2 0/4] Only export SME/SEV/SEV_ES features when activated

Currently SME/SEV/SEV_ES feature flags will export if the CPU supports
them but even if the kernel has not enabled the features for any reason.

To let userspace react to these feature flags, only set them when the
kernel has activated them.

changes from v1->v2:
 * Squash old patches 1/2 together
 * Add new patches to KVM/CCP code to use `cc_platform_has` instead
 * Don't use `cc_platform_has` in the early code, just check `sme_me_mask`
   and `sev_status` directly.
 * Split out SME and SEV/SEV_ES clearing as separate patches in case
   SEV/SEV_ES need other more involved work that what is in this series so
   far.

Mario Limonciello (4):
  crypto: ccp: Use cc_platform_has to determine SEV presence
  KVM: SVM: Use cc_platform_has instead of CPU feature flags
  x86/cpu: clear SME features when not in use
  x86/cpu: clear SEV/SEV_ES features when not in use

 arch/x86/kernel/cpu/amd.c    | 10 ++++++++++
 arch/x86/kernel/process.c    |  5 ++++-
 arch/x86/kvm/svm/sev.c       |  4 ++--
 drivers/crypto/ccp/sev-dev.c |  2 +-
 4 files changed, 17 insertions(+), 4 deletions(-)

-- 
2.34.1