linux-kernel - [PATCH v2 0/4] Export PSP security attributes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220329164117.1449-1-mario.limonciello@amd.com>
Date:   Tue, 29 Mar 2022 11:41:13 -0500
From:   Mario Limonciello <mario.limonciello@....com>
To:     Tom Lendacky <thomas.lendacky@....com>,
        John Allen <john.allen@....com>,
        Herbert Xu <herbert@...dor.apana.org.au>,
        "David S . Miller" <davem@...emloft.net>
CC:     open list <linux-kernel@...r.kernel.org>,
        "open list:AMD CRYPTOGRAPHIC COPROCESSOR (CCP) DRIVER" 
        <linux-crypto@...r.kernel.org>,
        Kerneis Gabriel <Gabriel.Kerneis@....gouv.fr>,
        Richard Hughes <hughsient@...il.com>,
        "Mario Limonciello" <mario.limonciello@....com>
Subject: [PATCH v2 0/4] Export PSP security attributes

Select AMD SOCs include the ability to export capabilities that
have been activated or detected by the platform security processor.

This information is useful for both system designers as well as system
administrators to ensure that the system has been properly locked down
to their expectations.

Software such as fwupd will also be modified to use this information
as part of the calculations for a security level score that may be
presented to a user.

This series also adds the ability to detect that TSME and SME are both
activated simultaneously to notify a user.  Previously a user could turn
on TSME and SME at the same time, but the kernel was unable to detect
that TSME was enabled in the OS.

This information is evaluated "too late" right now in the kernel to stop
the kernel from enabling SME, but if that is desirable at a later time
some of the early code can be modified to read the same information and
make that decision.

v1->v2:
 * Add cover letter to explain background
 * See individual patches for changes from v1.

Mario Limonciello (4):
  crypto: ccp: cache capability into psp device
  crypto: ccp: Export PSP security bits to userspace
  crypto: ccp: Allow PSP driver to load without SEV/TEE support
  crypto: ccp: When TSME and SME both detected notify user

 Documentation/ABI/testing/sysfs-driver-ccp | 87 ++++++++++++++++++++++
 drivers/crypto/ccp/psp-dev.c               | 46 ++++++------
 drivers/crypto/ccp/psp-dev.h               | 22 ++++++
 drivers/crypto/ccp/sp-dev.c                |  6 ++
 drivers/crypto/ccp/sp-pci.c                | 62 +++++++++++++++
 5 files changed, 202 insertions(+), 21 deletions(-)
 create mode 100644 Documentation/ABI/testing/sysfs-driver-ccp

-- 
2.34.1