mirror of
https://github.com/torvalds/linux.git
synced 2026-10-15 20:30:02 +02:00
2fdf279ccf
The SEV-SNP firmware provides the SNP_VERIFY_MITIGATION command, which
can be used to query the status of currently supported vulnerability
mitigations and to initiate mitigations within the firmware.
This command is an explicit mechanism to ascertain if a firmware
mitigation is applied without needing a full RMP re-build, which is most
useful in a live firmware update scenario.
The firmware supports two subcommands: STATUS and VERIFY. The STATUS
subcommand is used to query the supported and verified mitigation bits.
The VERIFY subcommand initiates the mitigation process within the FW for
the specified vulnerability. Expose a userspace interface under:
/sys/firmware/sev/vulnerabilities/
- supported_mitigations (read-only): supported mitigation vector mask
- verified_mitigations (read/write): current verified mask; write a
vector to request VERIFY for that bit
The behavior of SNP_VERIFY_MITIGATION and the pre-requisites for using
it are bug-specific. Information about supported mitigations and its
corresponding vector is to be published as part of the AMD Security
Bulletin.
See SEV-SNP Firmware ABI specifications 1.58, SNP_VERIFY_MITIGATION for
more details.
Reviewed-by: Tycho Andersen (AMD) <tycho@kernel.org>
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Pratik R. Sampat <prsampat@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
20 lines
776 B
Plaintext
20 lines
776 B
Plaintext
What: /sys/firmware/sev/vulnerabilities/supported_mitigations
|
|
Date: June 2026
|
|
Contact: linux-crypto@vger.kernel.org
|
|
Description:
|
|
Read-only interface that reports the vector of SEV-SNP
|
|
firmware vulnerability mitigations supported by the firmware.
|
|
|
|
What: /sys/firmware/sev/vulnerabilities/verified_mitigations
|
|
Date: June 2026
|
|
Contact: linux-crypto@vger.kernel.org
|
|
Description:
|
|
Read/write interface that reports the vector of SEV-SNP
|
|
firmware vulnerability mitigations already verified by the
|
|
firmware. Writing a vector value requests the firmware to
|
|
VERIFY the corresponding mitigation bit(s).
|
|
|
|
The list of supported mitigations and the meaning of each
|
|
vector bit are both platform- and bug-specific and are
|
|
published as part of the AMD Security Bulletin.
|