HP BIOS Configuration driver purpose is to provide a driver supporting
the latest sysfs class firmware attributes framework allowing the user
to change BIOS settings and security solutions on HP Inc.’s commercial
notebooks.
Many features of HP Commercial notebooks can be managed using Windows
Management Instrumentation (WMI). WMI is an implementation of Web-Based
Enterprise Management (WBEM) that provides a standards-based interface
for changing and monitoring system settings. HP BIOSCFG driver provides
a native Linux solution and the exposed features facilitates the
migration to Linux environments.
The Linux security features to be provided in hp-bioscfg driver enables
managing the BIOS settings and security solutions via sysfs, a virtual
filesystem that can be used by user-mode applications. The new
documentation cover features such Secure Platform Management and Sure
Start. Each section provides security feature description and
identifies sysfs directories and files exposed by the driver.
Many HP Commercial notebooks include a feature called Secure Platform
Management (SPM), which replaces older password-based BIOS settings
management with public key cryptography. PC secure product management
begins when a target system is provisioned with cryptographic keys
that are used to ensure the integrity of communications between system
management utilities and the BIOS.
HP Commercial notebooks have several BIOS settings that control its
behaviour and capabilities, many of which are related to security.
To prevent unauthorized changes to these settings, the system can
be configured to use a cryptographic signature-based authorization
string that the BIOS will use to verify authorization to modify the
setting.
Signed-off-by: Jorge Lopez <[email protected]>
---
Based on the latest platform-drivers-x86.git/for-next
History
Version 8
Includes only sysfs-class-firmware-attributes documentation
Version 7
Includes only sysfs-class-firmware-attributes documentation
---
.../testing/sysfs-class-firmware-attributes | 104 +++++++++++++++++-
1 file changed, 103 insertions(+), 1 deletion(-)
diff --git a/Documentation/ABI/testing/sysfs-class-firmware-attributes b/Documentation/ABI/testing/sysfs-class-firmware-attributes
index 4cdba3477176..574cdd8a6cc6 100644
--- a/Documentation/ABI/testing/sysfs-class-firmware-attributes
+++ b/Documentation/ABI/testing/sysfs-class-firmware-attributes
@@ -22,6 +22,12 @@ Description:
- integer: a range of numerical values
- string
+ HP specific types
+ -----------------
+ - ordered-list - a set of ordered list valid values
+ - sure-start - report audit logs read from BIOS
+
+
All attribute types support the following values:
current_value:
@@ -126,6 +132,44 @@ Description:
value will not be effective through sysfs until this rule is
met.
+ HP specific class extensions
+ ------------------------------
+
+ On HP systems the following additional attributes are available:
+
+ "ordered-list"-type specific properties:
+
+ elements:
+ A file that can be read to obtain the possible
+ list of values of the <attr>. Values are separated using
+ semi-colon (``;``). The order individual elements are listed
+ according to their priority. An Element listed first has the
+ highest priority. Writing the list in a different order to
+ current_value alters the priority order for the particular
+ attribute.
+
+ "sure-start"-type specific properties:
+
+ audit_log_entries:
+ A read-only file that returns the events in the log.
+ Values are separated using semi-colon (``;``)
+
+ Audit log entry format
+
+ Byte 0-15: Requested Audit Log entry (Each Audit log is 16 bytes)
+ Byte 16-127: Unused
+
+ audit_log_entry_count:
+ A read-only file that returns the number of existing audit log events available to be read.
+ Values are separated using comma (``,``)
+
+ [No of entries],[log entry size],[Max number of entries supported]
+
+ log entry size identifies audit log size for the current BIOS version.
+ The current size is 16 bytes but it can be to up to 128 bytes long
+ in future BIOS versions.
+
+
What: /sys/class/firmware-attributes/*/authentication/
Date: February 2021
KernelVersion: 5.11
@@ -206,7 +250,7 @@ Description:
Drivers may emit a CHANGE uevent when a password is set or unset
userspace may check it again.
- On Dell and Lenovo systems, if Admin password is set, then all BIOS attributes
+ On Dell, Lenovo and HP systems, if Admin password is set, then all BIOS attributes
require password validation.
On Lenovo systems if you change the Admin password the new password is not active until
the next boot.
@@ -296,6 +340,15 @@ Description:
echo "signature" > authentication/Admin/signature
echo "password" > authentication/Admin/certificate_to_password
+ HP specific class extensions
+ --------------------------------
+
+ On HP systems the following additional settings are available:
+
+ role: enhanced-bios-auth:
+ This role is specific to Secure Platform Management (SPM) attribute.
+ It requires configuring an endorsement (kek) and signing certificate (sk).
+
What: /sys/class/firmware-attributes/*/attributes/pending_reboot
Date: February 2021
@@ -364,3 +417,52 @@ Description:
use it to enable extra debug attributes or BIOS features for testing purposes.
Note that any changes to this attribute requires a reboot for changes to take effect.
+
+
+ HP specific class extensions - Secure Platform Manager (SPM)
+ --------------------------------
+
+What: /sys/class/firmware-attributes/*/authentication/SPM/kek
+Date: March 29
+KernelVersion: 5.18
+Contact: "Jorge Lopez" <[email protected]>
+Description: 'kek' Key-Encryption-Key is a write-only file that can be used to configure the
+ RSA public key that will be used by the BIOS to verify
+ signatures when setting the signing key. When written,
+ the bytes should correspond to the KEK certificate
+ (x509 .DER format containing an OU). The size of the
+ certificate must be less than or equal to 4095 bytes.
+
+
+What: /sys/class/firmware-attributes/*/authentication/SPM/sk
+Date: March 29
+KernelVersion: 5.18
+Contact: "Jorge Lopez" <[email protected]>
+Description: 'sk' Signature Key is a write-only file that can be used to configure the RSA
+ public key that will be used by the BIOS to verify signatures
+ when configuring BIOS settings and security features. When
+ written, the bytes should correspond to the modulus of the
+ public key. The exponent is assumed to be 0x10001.
+
+
+What: /sys/class/firmware-attributes/*/authentication/SPM/status
+Date: March 29
+KernelVersion: 5.18
+Contact: "Jorge Lopez" <[email protected]>
+Description: 'status' is a read-only file that returns ASCII text reporting
+ the status information.
+
+ State: Not Provisioned / Provisioned / Provisioning in progress
+ Version: Major. Minor
+ Feature Bit Mask: <16-bit unsigned number display in hex>
+ SPM Counter: <16-bit unsigned number display in base 10>
+ Signing Key Public Key Modulus (base64): <256 bytes base64 in hex>
+ KEK Public Key Modulus (base64): <256 bytes base64 in hex>
+
+
+What: /sys/class/firmware-attributes/*/authentication/SPM/statusbin
+Date: March 29
+KernelVersion: 5.18
+Contact: "Jorge Lopez" <[email protected]>
+Description: 'statusbin' is a read-only file that returns identical status
+ information reported by 'status' file in binary format.
--
2.34.1
On Tue, Apr 11, 2023 at 01:47:34PM -0500, Jorge Lopez wrote:
> HP BIOS Configuration driver purpose is to provide a driver supporting
> the latest sysfs class firmware attributes framework allowing the user
> to change BIOS settings and security solutions on HP Inc.’s commercial
> notebooks.
>
> Many features of HP Commercial notebooks can be managed using Windows
> Management Instrumentation (WMI). WMI is an implementation of Web-Based
> Enterprise Management (WBEM) that provides a standards-based interface
> for changing and monitoring system settings. HP BIOSCFG driver provides
> a native Linux solution and the exposed features facilitates the
> migration to Linux environments.
>
> The Linux security features to be provided in hp-bioscfg driver enables
> managing the BIOS settings and security solutions via sysfs, a virtual
> filesystem that can be used by user-mode applications. The new
> documentation cover features such Secure Platform Management and Sure
> Start. Each section provides security feature description and
> identifies sysfs directories and files exposed by the driver.
>
> Many HP Commercial notebooks include a feature called Secure Platform
> Management (SPM), which replaces older password-based BIOS settings
> management with public key cryptography. PC secure product management
> begins when a target system is provisioned with cryptographic keys
> that are used to ensure the integrity of communications between system
> management utilities and the BIOS.
>
> HP Commercial notebooks have several BIOS settings that control its
> behaviour and capabilities, many of which are related to security.
> To prevent unauthorized changes to these settings, the system can
> be configured to use a cryptographic signature-based authorization
> string that the BIOS will use to verify authorization to modify the
> setting.
The patch description should also adds:
"Document HP-specific firmware sysfs attributes."
> diff --git a/Documentation/ABI/testing/sysfs-class-firmware-attributes b/Documentation/ABI/testing/sysfs-class-firmware-attributes
> index 4cdba3477176..574cdd8a6cc6 100644
> --- a/Documentation/ABI/testing/sysfs-class-firmware-attributes
> +++ b/Documentation/ABI/testing/sysfs-class-firmware-attributes
> @@ -22,6 +22,12 @@ Description:
> - integer: a range of numerical values
> - string
>
> + HP specific types
> + -----------------
> + - ordered-list - a set of ordered list valid values
> + - sure-start - report audit logs read from BIOS
> +
> +
> All attribute types support the following values:
>
> current_value:
> @@ -126,6 +132,44 @@ Description:
> value will not be effective through sysfs until this rule is
> met.
>
> + HP specific class extensions
> + ------------------------------
> +
> + On HP systems the following additional attributes are available:
> +
> + "ordered-list"-type specific properties:
> +
> + elements:
> + A file that can be read to obtain the possible
> + list of values of the <attr>. Values are separated using
> + semi-colon (``;``). The order individual elements are listed
> + according to their priority. An Element listed first has the
> + highest priority. Writing the list in a different order to
> + current_value alters the priority order for the particular
> + attribute.
> +
> + "sure-start"-type specific properties:
> +
> + audit_log_entries:
> + A read-only file that returns the events in the log.
> + Values are separated using semi-colon (``;``)
> +
> + Audit log entry format
> +
> + Byte 0-15: Requested Audit Log entry (Each Audit log is 16 bytes)
> + Byte 16-127: Unused
> +
> + audit_log_entry_count:
> + A read-only file that returns the number of existing audit log events available to be read.
> + Values are separated using comma (``,``)
> +
> + [No of entries],[log entry size],[Max number of entries supported]
> +
> + log entry size identifies audit log size for the current BIOS version.
> + The current size is 16 bytes but it can be to up to 128 bytes long
> + in future BIOS versions.
> +
> +
> What: /sys/class/firmware-attributes/*/authentication/
> Date: February 2021
> KernelVersion: 5.11
> @@ -206,7 +250,7 @@ Description:
> Drivers may emit a CHANGE uevent when a password is set or unset
> userspace may check it again.
>
> - On Dell and Lenovo systems, if Admin password is set, then all BIOS attributes
> + On Dell, Lenovo and HP systems, if Admin password is set, then all BIOS attributes
> require password validation.
> On Lenovo systems if you change the Admin password the new password is not active until
> the next boot.
> @@ -296,6 +340,15 @@ Description:
> echo "signature" > authentication/Admin/signature
> echo "password" > authentication/Admin/certificate_to_password
>
> + HP specific class extensions
> + --------------------------------
> +
> + On HP systems the following additional settings are available:
> +
> + role: enhanced-bios-auth:
> + This role is specific to Secure Platform Management (SPM) attribute.
> + It requires configuring an endorsement (kek) and signing certificate (sk).
> +
>
> What: /sys/class/firmware-attributes/*/attributes/pending_reboot
> Date: February 2021
> @@ -364,3 +417,52 @@ Description:
> use it to enable extra debug attributes or BIOS features for testing purposes.
>
> Note that any changes to this attribute requires a reboot for changes to take effect.
> +
> +
> + HP specific class extensions - Secure Platform Manager (SPM)
> + --------------------------------
> +
> +What: /sys/class/firmware-attributes/*/authentication/SPM/kek
> +Date: March 29
> +KernelVersion: 5.18
> +Contact: "Jorge Lopez" <[email protected]>
> +Description: 'kek' Key-Encryption-Key is a write-only file that can be used to configure the
> + RSA public key that will be used by the BIOS to verify
> + signatures when setting the signing key. When written,
> + the bytes should correspond to the KEK certificate
> + (x509 .DER format containing an OU). The size of the
> + certificate must be less than or equal to 4095 bytes.
> +
> +
> +What: /sys/class/firmware-attributes/*/authentication/SPM/sk
> +Date: March 29
> +KernelVersion: 5.18
> +Contact: "Jorge Lopez" <[email protected]>
> +Description: 'sk' Signature Key is a write-only file that can be used to configure the RSA
> + public key that will be used by the BIOS to verify signatures
> + when configuring BIOS settings and security features. When
> + written, the bytes should correspond to the modulus of the
> + public key. The exponent is assumed to be 0x10001.
> +
> +
> +What: /sys/class/firmware-attributes/*/authentication/SPM/status
> +Date: March 29
> +KernelVersion: 5.18
> +Contact: "Jorge Lopez" <[email protected]>
> +Description: 'status' is a read-only file that returns ASCII text reporting
> + the status information.
> +
> + State: Not Provisioned / Provisioned / Provisioning in progress
> + Version: Major. Minor
> + Feature Bit Mask: <16-bit unsigned number display in hex>
> + SPM Counter: <16-bit unsigned number display in base 10>
> + Signing Key Public Key Modulus (base64): <256 bytes base64 in hex>
> + KEK Public Key Modulus (base64): <256 bytes base64 in hex>
> +
> +
> +What: /sys/class/firmware-attributes/*/authentication/SPM/statusbin
> +Date: March 29
> +KernelVersion: 5.18
> +Contact: "Jorge Lopez" <[email protected]>
> +Description: 'statusbin' is a read-only file that returns identical status
> + information reported by 'status' file in binary format.
The wording and formatting can be improved:
---- >8 ----
diff --git a/Documentation/ABI/testing/sysfs-class-firmware-attributes b/Documentation/ABI/testing/sysfs-class-firmware-attributes
index 574cdd8a6cc694..2b2309c93c1c21 100644
--- a/Documentation/ABI/testing/sysfs-class-firmware-attributes
+++ b/Documentation/ABI/testing/sysfs-class-firmware-attributes
@@ -22,10 +22,10 @@ Description:
- integer: a range of numerical values
- string
- HP specific types
+ HP-specific types
-----------------
- - ordered-list - a set of ordered list valid values
- - sure-start - report audit logs read from BIOS
+ - ordered-list: a set of ordered list valid values
+ - sure-start: report audit logs read from BIOS
All attribute types support the following values:
@@ -137,33 +137,32 @@ Description:
On HP systems the following additional attributes are available:
- "ordered-list"-type specific properties:
+ * "ordered-list"-type specific properties:
- elements:
- A file that can be read to obtain the possible
- list of values of the <attr>. Values are separated using
- semi-colon (``;``). The order individual elements are listed
- according to their priority. An Element listed first has the
- highest priority. Writing the list in a different order to
- current_value alters the priority order for the particular
- attribute.
+ elements:
+ (RW) A file that contains semicolon-separated list of possible
+ values of the <attr>, ordered by their priority. The first
+ listed element has the highest priority. Writing the list
+ in a different order to current_value alters the priority
+ order for the particular attribute.
- "sure-start"-type specific properties:
+ * "sure-start"-type specific properties:
- audit_log_entries:
- A read-only file that returns the events in the log.
- Values are separated using semi-colon (``;``)
+ audit_log_entries:
+ (RO) Returns the events in the log. Log entries are
+ semicolon-separated.
- Audit log entry format
+ Audit log entry format:
- Byte 0-15: Requested Audit Log entry (Each Audit log is 16 bytes)
- Byte 16-127: Unused
+ * Byte 0-15: Requested Audit Log entry (Each Audit log is 16 bytes)
+ * Byte 16-127: Unused
- audit_log_entry_count:
- A read-only file that returns the number of existing audit log events available to be read.
- Values are separated using comma (``,``)
+ audit_log_entry_count:
+ (RO) Returns the number of existing audit log events available to be read.
- [No of entries],[log entry size],[Max number of entries supported]
+ The file format is::
+
+ [No of entries],[log entry size],[Max number of entries supported]
log entry size identifies audit log size for the current BIOS version.
The current size is 16 bytes but it can be to up to 128 bytes long
@@ -426,19 +425,19 @@ What: /sys/class/firmware-attributes/*/authentication/SPM/kek
Date: March 29
KernelVersion: 5.18
Contact: "Jorge Lopez" <[email protected]>
-Description: 'kek' Key-Encryption-Key is a write-only file that can be used to configure the
+Description: (WO) Key-Encryption-Key (KEK) file that can be used to configure the
RSA public key that will be used by the BIOS to verify
signatures when setting the signing key. When written,
the bytes should correspond to the KEK certificate
- (x509 .DER format containing an OU). The size of the
- certificate must be less than or equal to 4095 bytes.
+ (x509 .DER format containing an OU). The certificate size
+ must be less than or equal to 4095 bytes.
What: /sys/class/firmware-attributes/*/authentication/SPM/sk
Date: March 29
KernelVersion: 5.18
Contact: "Jorge Lopez" <[email protected]>
-Description: 'sk' Signature Key is a write-only file that can be used to configure the RSA
+Description: (WO) Signature Key (SK) file that can be used to configure the RSA
public key that will be used by the BIOS to verify signatures
when configuring BIOS settings and security features. When
written, the bytes should correspond to the modulus of the
@@ -449,20 +448,21 @@ What: /sys/class/firmware-attributes/*/authentication/SPM/status
Date: March 29
KernelVersion: 5.18
Contact: "Jorge Lopez" <[email protected]>
-Description: 'status' is a read-only file that returns ASCII text reporting
- the status information.
+Description: (RO) Returns status information report in text format.
- State: Not Provisioned / Provisioned / Provisioning in progress
- Version: Major. Minor
- Feature Bit Mask: <16-bit unsigned number display in hex>
- SPM Counter: <16-bit unsigned number display in base 10>
- Signing Key Public Key Modulus (base64): <256 bytes base64 in hex>
- KEK Public Key Modulus (base64): <256 bytes base64 in hex>
+ The fields are:
+
+ * State: Not Provisioned / Provisioned / Provisioning in progress
+ * Version: version number (<major>.<minor>)
+ * Feature Bit Mask: 16-bit unsigned number display in hex
+ * SPM Counter: 16-bit unsigned number display in base 10
+ * Signing Key Public Key Modulus (base64): 256 bytes base64 in hex
+ * KEK Public Key Modulus (base64): 256 bytes base64 in hex
What: /sys/class/firmware-attributes/*/authentication/SPM/statusbin
Date: March 29
KernelVersion: 5.18
Contact: "Jorge Lopez" <[email protected]>
-Description: 'statusbin' is a read-only file that returns identical status
- information reported by 'status' file in binary format.
+Description: (RO) Return status information report in binary format. The fields
+ are same as returned by status sysfs above.
Thanks.
--
An old man doll... just what I always wanted! - Clara