CPUs generally come with multiple built-in hardware security capabilities—CSV security virtualization, TPM/TCM/TKM trusted encryption,TDM trusted measurement, and more. However, for these capabilities to truly take effect, coordinated configuration across three layers—CPU hardware, firmware (BIOS/UEFI), and operating system—is required. If any layer is missing, the security features become a mere decoration. Traditional detection tools can only check individual points and cannot verify the full chain—this is precisely the long-missing link in platform-level underlying security operations and maintenance.

Platform Security Patrol implements automated scanning with full coverage of platform security capabilities, verifying item by item the running status of core trusted modules such as CSV, TPM, TCM,TKM, and TDM, and supports two standardized output formats: table and JSON. Each security capability clearly displays the running status across all three layers, with aggregated counts of available, disabled, and unsupported items—operations personnel can intuitively grasp the entire machine's security baseline without line-by-line troubleshooting.

Name       Overall Status  CPU Layer   Firmware Layer  OS Layer     Description-----------------------------------------------------------------------------------csv1       available       supported   supported       available    N/Acsv2       available       supported   supported       available    N/Atpm2.0     disabled        supported   supported       unavailable  Kernel config not enabledtcm2.0     available       supported   supported       available    N/A Total: 4 capabilities  Available: 3, Disabled: 1, Unsupported: 0, Unavailable: 0

Traditional security detection tools often only provide vague "available/unavailable" conclusions without telling users where the problem lies. This tool introduces a three-layer penetrating detection mechanism, independently testing each security capability from three dimensions—CPU hardware layer, firmware layer, and operating system layer—to precisely locate the fault type:

For example, in the table above, tpm2.0 shows "disabled," and the OS layer is marked "Kernel config not enabled"—where the problem lies and what to do, a process that originally required manual layer-by-layer troubleshooting, is now compressed to seconds. The layered diagnostic positioning capability compresses the manual troubleshooting process to seconds, greatly reducing the labor cost of security operations and maintenance for servers and terminals.

Finding the problem is only the first step; this tool comes with complete, actionable solutions, connecting the entire "find the problem—solve the problem" workflow:

Tiered repair guidance: For different scenarios such as BIOS settings and kernel compilation, it outputs both quick temporary solutions and permanent standardized configuration plans, guiding operations staff step by step to enable security capabilities;

Hardware security misoperation blocking: For hardware-level security features (such as capabilities that can only be disabled via BIOS), the disable command clearly states that the capability does not support software-level disabling, serving as a security policy block to prevent misoperation.

Platform Security Patrol provides a rich set of commands and output options, flexibly adapting to different operations and maintenance scenarios.

Capability overview: Quickly view the full list of the machine's native security capabilities to quickly understand the platform's security foundation;

plat-sec-patrol list

Routine inspection: One-click detection of all security modules with table-based visual output, suitable for periodic baseline verification;

plat-sec-patrol check

Single-item troubleshooting: Targeted detection of a single trusted module such as TCM or TPM for in-depth investigation of a specific security capability;

plat-sec-patrol check tcm

Automated integration: Outputs standard structured data that can be directly integrated with automated operations platforms, monitoring dashboards, and CI/CD pipelines for continuous monitoring of security status.

plat-sec-patrol check --format json

Hardware security interface specifications vary among CPU vendors, and traditional detection tools require independent development for different platforms, resulting in high maintenance costs. Platform Security Patrol adopts a plugin architecture that decouples the engine from hardware platforms:

Adding a new processor platform: Only requires developing a matching collection plugin plus a JSON capability definition file—the core detection code needs no modification or recompilation;

Adding a new security detection item: Only requires updating the configuration file to take effect, with an extremely low development threshold.

The tool is currently fully adapted toHygon C86-3G、C86-4G two generations of processors, supporting CSV1/2/3 security virtualization, TPM2.0, TCM2.0, TKM trusted keys, TDM trusted measurementand all other mainstream underlying security features, applicable across servers and desktop terminals in all scenarios.

sudo apt install platform-security-patrol

Platform Security Patrol is developed and maintained by the Trusted Computing SIG of the openKylin community. It is an underlying hardware security capability detection and enablement tool built for domestic CPU platforms, focusing on the pain points of domestic software and hardware adaptation. It provides a one-stop solution for verifying security and trusted capabilities, troubleshooting faults, and standardizing configuration on domestic platforms, suitable for security inspections of all types of domestic devices, including government and enterprise office terminals and data center servers.

Trusted Computing SIGCommitted totrusted computingopen-source foundational software and optimization, and providing application specifications and interfaces related to trusted computing, exploring the application practices of trusted computing technologies both domestically and internationally. Next steps include continuously expanding the list of adapted trusted CPUs, enriching the detection dimensions of trusted security capabilities, and simultaneously developing a visual graphical inspection panel and remote batch inspection functionality. Developers and operations practitioners are welcome to join the community to jointly improve the domestic underlying security toolchain.

Project address:

https://gitee.com/openkylin/platform-security-patrol

Trusted Computing SIG homepage:

https://gitee.com/openkylin/community/tree/master/sig/TrustedComputing