| /linux-6.12.1/Documentation/ABI/testing/ |
| D | securityfs-secrets-coco | 1 What: security/secrets/coco
5 Exposes confidential computing (coco) EFI secrets to
10 the Guest Owner during VM's launch. The secrets are encrypted
14 The efi_secret module exposes the secrets to userspace. Each
15 secret appears as a file under <securityfs>/secrets/coco,
16 where the filename is the GUID of the entry in the secrets
26 For example, listing the available secrets::
29 # ls -l /sys/kernel/security/secrets/coco
37 # cat /sys/kernel/security/secrets/coco/e6f5a162-d67f-4750-a67c-5d065f2a9910
42 # rm /sys/kernel/security/secrets/coco/e6f5a162-d67f-4750-a67c-5d065f2a9910
[all …]
|
| /linux-6.12.1/Documentation/security/secrets/ |
| D | coco.rst | 4 Confidential Computing secrets
16 Virtualization) allows guest owners to inject secrets into the VMs
22 secrets via securityfs.
48 secrets to userspace applications via securityfs. The details of the
49 efi_secret filesystem interface are in [secrets-coco-abi]_.
68 to which an EFI secret area with 4 secrets was injected during launch::
70 # ls -la /sys/kernel/security/secrets/coco
79 # hd /sys/kernel/security/secrets/coco/e6f5a162-d67f-4750-a67c-5d065f2a9910
81 00000010 74 61 2d 73 65 63 72 65 74 73 00 01 02 03 04 05 |ta-secrets......|
85 # rm /sys/kernel/security/secrets/coco/e6f5a162-d67f-4750-a67c-5d065f2a9910
[all …]
|
| /linux-6.12.1/drivers/virt/coco/sev-guest/ |
| D | sev-guest.c | 63 struct snp_secrets_page *secrets; member
756 static u8 *get_vmpck(int id, struct snp_secrets_page *secrets, u32 **seqno) in get_vmpck() argument
762 *seqno = &secrets->os_area.msg_seqno_0; in get_vmpck()
763 key = secrets->vmpck0; in get_vmpck()
766 *seqno = &secrets->os_area.msg_seqno_1; in get_vmpck()
767 key = secrets->vmpck1; in get_vmpck()
770 *seqno = &secrets->os_area.msg_seqno_2; in get_vmpck()
771 key = secrets->vmpck2; in get_vmpck()
774 *seqno = &secrets->os_area.msg_seqno_3; in get_vmpck()
775 key = secrets->vmpck3; in get_vmpck()
[all …]
|
| /linux-6.12.1/drivers/s390/char/ |
| D | uvdevice.c | 325 void *secrets = NULL; in uvio_list_secrets() local
331 secrets = kvzalloc(UVIO_LIST_SECRETS_LEN, GFP_KERNEL); in uvio_list_secrets()
332 if (!secrets) in uvio_list_secrets()
335 uvcb.addr = (u64)secrets; in uvio_list_secrets()
340 if (copy_to_user(user_buf_arg, secrets, UVIO_LIST_SECRETS_LEN)) in uvio_list_secrets()
343 kvfree(secrets); in uvio_list_secrets()
|
| /linux-6.12.1/drivers/virt/coco/efi_secret/ |
| D | Kconfig | 11 guests). The driver exposes the secrets as files in
12 <securityfs>/secrets/coco. Files can be read and deleted (deleting
|
| /linux-6.12.1/drivers/firmware/efi/ |
| D | Kconfig | 183 still contains secrets in RAM, booting another OS and extracting the
184 secrets. This should only be enabled when userland is configured to
185 clear the MemoryOverwriteRequest flag on clean shutdown after secrets
261 Guest Owner to securely inject secrets during guest VM launch.
262 The secrets are placed in a designated EFI reserved memory area.
264 In order to use the secrets in the kernel, the location of the secret
269 virt/coco/efi_secret module to access the secrets, which in turn
270 allows userspace programs to access the injected secrets.
|
| /linux-6.12.1/Documentation/security/ |
| D | index.rst | 21 secrets/index
|
| D | self-protection.rst | 204 Canaries, blinding, and other secrets
|
| /linux-6.12.1/Documentation/security/tpm/ |
| D | xen-tpmfront.rst | 18 of the vTPM's secrets (Keys, NVRAM, etc) are managed by a vTPM Manager domain,
19 which seals the secrets to the Physical TPM. If the process of creating each of
|
| D | tpm-security.rst | 33 secrets and integrity as far as we are able in this environment and to
53 a trusted state and release secrets
97 Obviously using the null seed without any other prior shared secrets,
|
| /linux-6.12.1/Documentation/admin-guide/hw-vuln/ |
| D | reg-file-data-sampling.rst | 45 attacker can extract the secrets. This is achieved by using the otherwise
|
| D | processor_mmio_stale_data.rst | 154 an attacker can extract the secrets.
190 MDS/TAA, guest without MMIO access cannot extract secrets using Processor MMIO
|
| D | l1tf.rst | 193 paths have been verified that they cannot expose secrets or other
563 nested virtual machine, so that the nested hypervisor's secrets are not
568 cache avoids that the bare metal hypervisor's secrets are exposed to the
|
| D | spectre.rst | 622 For security-sensitive programs that have secrets (e.g. crypto
|
| /linux-6.12.1/security/keys/ |
| D | Kconfig | 123 public keys and shared secrets using values stored as keys
|
| /linux-6.12.1/arch/powerpc/platforms/pseries/ |
| D | Kconfig | 161 # used to store asymmetric public keys or secrets as required
|
| /linux-6.12.1/arch/x86/coco/sev/ |
| D | core.c | 755 struct snp_secrets_page *secrets; in get_snp_jump_table_addr() local
769 secrets = (__force struct snp_secrets_page *)mem; in get_snp_jump_table_addr()
771 addr = secrets->os_area.ap_jump_table_pa; in get_snp_jump_table_addr()
|
| /linux-6.12.1/Documentation/ABI/stable/ |
| D | sysfs-class-tpm | 117 secrets, it can't authorize its own request for the pubek,
|
| /linux-6.12.1/Documentation/virt/coco/ |
| D | sev-guest.rst | 188 Endorsement Key (VCEK), which is derived from chip-unique secrets, or a
|
| /linux-6.12.1/Documentation/networking/device_drivers/cable/ |
| D | sb1000.rst | 93 phone number, and frequency for the cable modem. Also edit pap-secrets
|
| /linux-6.12.1/Documentation/virt/kvm/x86/ |
| D | amd-memory-encryption.rst | 502 secrets.
|
| /linux-6.12.1/Documentation/arch/x86/ |
| D | tdx.rst | 402 entities before provisioning secrets to the guest. For example, a key
|
| /linux-6.12.1/Documentation/networking/ |
| D | tls-offload.rst | 132 * crypto secrets (key, iv, salt)
|
| /linux-6.12.1/Documentation/security/keys/ |
| D | core.rst | 131 blob of data. It is intended as a place to store secrets which are
|