linux-kernel - Re: [PATCH v2 0/5] Enable PSP security attributes on more SoCs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 29 May 2024 08:07:52 +0000
From: Richard Hughes <richard@...hsie.com>
To: Mario Limonciello <mario.limonciello@....com>
Cc: Herbert Xu <herbert@...dor.apana.org.au>, Tom Lendacky <thomas.lendacky@....com>, "open list:AMD CRYPTOGRAPHIC COPROCESSOR (CCP) DRIVER - DB..." <linux-crypto@...r.kernel.org>, Richard Hughes <hughsient@...il.com>, open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2 0/5] Enable PSP security attributes on more SoCs

On Tuesday, May 28th, 2024 at 10:07 PM, Mario Limonciello <mario.limonciello@....com> wrote:
> v1->v2:

Looks great, and the output of "fwupdmgr security" on my pre-production Lenovo T14 (AMD Ryzen 7 PRO 4750U) is now a lot more accurate:

 HSI-1
 ✔ BIOS firmware updates:         Enabled
+✔ Fused platform:                Locked
+✔ Supported CPU:                 Valid
 ✔ TPM empty PCRs:                Valid
 ✔ TPM v2.0:                      Found
 ✔ UEFI bootservice variables:    Locked
 ✔ UEFI platform key:             Valid
 
 HSI-2
 ✔ IOMMU:                         Enabled
+✔ Platform debugging:            Locked
 ✔ TPM PCR0 reconstruction:       Valid
+✘ SPI write protection:          Disabled
 ✘ BIOS rollback protection:      Disabled
 
 HSI-3
+✘ SPI replay protection:         Not supported
 ✘ CET Platform:                  Not supported
 ✘ Pre-boot DMA protection:       Disabled
 ✘ Suspend-to-idle:               Disabled
 ✘ Suspend-to-ram:                Enabled
 
 HSI-4
+✔ Encrypted RAM:                 Encrypted
 ✔ SMAP:                          Enabled
+✘ Processor rollback protection: Disabled

Tested-by: Richard Hughes <richard@...hsie.com>

Richard