lkml.org 
[lkml]   [2020]   [Jul]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH] Platform lockdown information in SYSFS
    On Thu, Jul 30, 2020 at 7:33 PM Randy Dunlap <rdunlap@infradead.org> wrote:
    >
    > Hi,
    >
    > Could we get some consistency in the use of "bios" vs. "Bios" vs. "BIOS", please.
    > BIOS is preferred IMO.

    OK for the next patch.

    >
    > On 7/30/20 2:41 PM, Daniel Gutson wrote:
    > >
    > > This initial version exports the BIOS Write Enable (bioswe),
    > > BIOS Lock Enable (ble), and the SMM Bios Write Protect (SMM_BWP)
    > > fields of the Bios Control register. The idea is to keep adding more
    > > flags, not only from the BC but also from other registers in following
    > > versions.
    > >
    > > The goal is that the attributes are avilable to fwupd when SecureBoot
    >
    > available
    >
    > > is turned on.
    > >
    > > The patch provides a new misc driver, as proposed in the previous patch,
    > > that provides a registration function for HW Driver devices to register
    > > class_attributes.
    > > In this case, the intel SPI flash chip (intel-spi) registers three
    > > class_attributes corresponding to the fields mentioned above.
    > >
    > > Signed-off-by: Daniel Gutson <daniel.gutson@eclypsium.com>
    > > ---
    > > .../ABI/stable/sysfs-class-platform-lockdown | 23 +++++++
    > > MAINTAINERS | 7 +++
    > > drivers/misc/Kconfig | 9 +++
    > > drivers/misc/Makefile | 1 +
    > > drivers/misc/platform-lockdown-attrs.c | 57 +++++++++++++++++
    > > drivers/mtd/spi-nor/controllers/Kconfig | 1 +
    > > .../mtd/spi-nor/controllers/intel-spi-pci.c | 49 +++++++++++++++
    > > drivers/mtd/spi-nor/controllers/intel-spi.c | 62 +++++++++++++++++++
    > > .../platform_data/platform-lockdown-attrs.h | 19 ++++++
    > > 9 files changed, 228 insertions(+)
    > > create mode 100644 Documentation/ABI/stable/sysfs-class-platform-lockdown
    > > create mode 100644 drivers/misc/platform-lockdown-attrs.c
    > > create mode 100644 include/linux/platform_data/platform-lockdown-attrs.h
    > >
    > > diff --git a/Documentation/ABI/stable/sysfs-class-platform-lockdown b/Documentation/ABI/stable/sysfs-class-platform-lockdown
    > > new file mode 100644
    > > index 000000000000..6034d6cbefac
    > > --- /dev/null
    > > +++ b/Documentation/ABI/stable/sysfs-class-platform-lockdown
    > > @@ -0,0 +1,23 @@
    > > +What: /sys/class/platform-lockdown/bioswe
    > > +Date: July 2020
    > > +KernelVersion: 5.8.0
    > > +Contact: Daniel Gutson <daniel.gutson@eclypsium.com>
    > > +Description: If the system firmware set BIOS Write Enable.
    > > + 0: writes disabled, 1: writes enabled.
    > > +Users: https://github.com/fwupd/fwupd
    > > +
    > > +What: /sys/class/platform-lockdown/ble
    > > +Date: July 2020
    > > +KernelVersion: 5.8.0
    > > +Contact: Daniel Gutson <daniel.gutson@eclypsium.com>
    > > +Description: If the system firmware set Bios Lock Enable.
    >
    > BIOS
    >
    > > + 0: SMM lock disabled, 1: SMM lock enabled.
    > > +Users: https://github.com/fwupd/fwupd
    > > +
    > > +What: /sys/class/platform-lockdown/smm_bwp
    > > +Date: July 2020
    > > +KernelVersion: 5.8.0
    > > +Contact: Daniel Gutson <daniel.gutson@eclypsium.com>
    > > +Description: If the system firmware set SMM Bios Write Protect.
    >
    > BIOS
    >
    > > + 0: writes disabled unless in SMM, 1: writes enabled.
    > > +Users: https://github.com/fwupd/fwupd
    >
    >
    >
    > cheers.
    > --
    > ~Randy
    >


    --
    Daniel Gutson
    Argentina Site Director
    Enginieering Director
    Eclypsium

    Below The Surface: Get the latest threat research and insights on
    firmware and supply chain threats from the research team at Eclypsium.
    https://eclypsium.com/research/#threatreport

    \
     
     \ /
      Last update: 2020-07-31 00:41    [W:5.733 / U:1.668 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site