linux-kernel - Re: [PATCH] crypto: ccp - State in dmesg that TSME is enabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <28f55bf4-4ce6-4913-837e-2d04d53ff2df@amd.com>
Date: Tue, 6 Feb 2024 12:56:48 -0600
From: Tom Lendacky <thomas.lendacky@....com>
To: Borislav Petkov <bp@...en8.de>
Cc: John Allen <john.allen@....com>, linux-crypto@...r.kernel.org,
 LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] crypto: ccp - State in dmesg that TSME is enabled

On 2/5/24 09:46, Borislav Petkov wrote:
> From: "Borislav Petkov (AMD)" <bp@...en8.de>
> 
> In the case when only TSME is enabled, it is useful to state that fact
> too, so that users are aware that memory encryption is still enabled
> even when the corresponding software variant of memory encryption is not
> enabled.
> 
> Signed-off-by: Borislav Petkov (AMD) <bp@...en8.de>

Acked-by: Tom Lendacky <thomas.lendacky@....com>

> ---
>   drivers/crypto/ccp/psp-dev.c | 11 +++++++----
>   1 file changed, 7 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/crypto/ccp/psp-dev.c b/drivers/crypto/ccp/psp-dev.c
> index 124a2e0c8999..56bf832c2947 100644
> --- a/drivers/crypto/ccp/psp-dev.c
> +++ b/drivers/crypto/ccp/psp-dev.c
> @@ -156,11 +156,14 @@ static unsigned int psp_get_capability(struct psp_device *psp)
>   	}
>   	psp->capability = val;
>   
> -	/* Detect if TSME and SME are both enabled */
> +	/* Detect TSME and/or SME status */
>   	if (PSP_CAPABILITY(psp, PSP_SECURITY_REPORTING) &&
> -	    psp->capability & (PSP_SECURITY_TSME_STATUS << PSP_CAPABILITY_PSP_SECURITY_OFFSET) &&
> -	    cc_platform_has(CC_ATTR_HOST_MEM_ENCRYPT))
> -		dev_notice(psp->dev, "psp: Both TSME and SME are active, SME is unnecessary when TSME is active.\n");
> +	    psp->capability & (PSP_SECURITY_TSME_STATUS << PSP_CAPABILITY_PSP_SECURITY_OFFSET)) {
> +		if (cc_platform_has(CC_ATTR_HOST_MEM_ENCRYPT))
> +			dev_notice(psp->dev, "psp: Both TSME and SME are active, SME is unnecessary when TSME is active.\n");
> +		else
> +			dev_notice(psp->dev, "psp: TSME enabled\n");
> +	}
>   
>   	return 0;
>   }