On Tue, Jul 05, 2022 at 02:35:18PM -0300, Martin Fernandez wrote:
On 7/4/22, Greg KH gregkh@linuxfoundation.org wrote:
On Mon, Jul 04, 2022 at 10:58:33AM -0300, Martin Fernandez wrote:
Show in each node in sysfs if its memory is able to do be encrypted by the CPU; on EFI systems: if all its memory is marked with EFI_MEMORY_CPU_CRYPTO in the EFI memory map.
Signed-off-by: Martin Fernandez martin.fernandez@eclypsium.com
Documentation/ABI/testing/sysfs-devices-node | 10 ++++++++++ drivers/base/node.c | 10 ++++++++++ 2 files changed, 20 insertions(+) create mode 100644 Documentation/ABI/testing/sysfs-devices-node
diff --git a/Documentation/ABI/testing/sysfs-devices-node b/Documentation/ABI/testing/sysfs-devices-node new file mode 100644 index 000000000000..0e95420bd7c5 --- /dev/null +++ b/Documentation/ABI/testing/sysfs-devices-node @@ -0,0 +1,10 @@ +What: /sys/devices/system/node/nodeX/crypto_capable +Date: April 2022 +Contact: Martin Fernandez martin.fernandez@eclypsium.com +Users: fwupd (https://fwupd.org) +Description:
This value is 1 if all system memory in this node iscapable of being protected with the CPU's memorycryptographic capabilities. It is 0 otherwise.On EFI systems the node will be marked withEFI_MEMORY_CPU_CRYPTO.Where will such a node be "marked"? I do not understand this last sentence, sorry, can you please reword this?
What I meant is that if all the memory regions in a given node are flagged with EFI_MEMORY_CPU_CRYPTO then that file will hold a 1.
Maybe it's a little confusing if you don't know what EFI_MEMORY_CPU_CRYPTO is.
And why is EFI an issue here at all?
Checking for EFI_MEMORY_CPU_CRYPTO is the way to know if a memory region is able to be encrypted by the CPU on EFI platforms. It's not really an issue and it's currently the only implementation for this file.
Is it clearer here?
This value is 1 if the memory in this node is capable of being protected with the CPU's memory cryptographic capabilities. It is 0 otherwise. On EFI systems this means that all the memory regions of the node have the EFI_MEMORY_CPU_CRYPTO attribute set.
Much better, thanks.
greg k-h