1 What: /sys/firmware/secvar
3 Contact: Nayna Jain <nayna@linux.ibm.com>
4 Description: This directory is created if the POWER firmware supports OS
5 secureboot, thereby secure variables. It exposes interface
6 for reading/writing the secure variables
8 What: /sys/firmware/secvar/vars
10 Contact: Nayna Jain <nayna@linux.ibm.com>
11 Description: This directory lists all the secure variables that are supported
14 What: /sys/firmware/secvar/format
16 Contact: Nayna Jain <nayna@linux.ibm.com>
17 Description: A string indicating which backend is in use by the firmware.
18 This determines the format of the variable and the accepted
19 format of variable updates.
21 On powernv/OPAL, this value is provided by the OPAL firmware
22 and is expected to be "ibm,edk2-compat-v1".
24 On pseries/PLPKS, this is generated by the kernel based on the
25 version number in the SB_VERSION variable in the keystore, and
26 has the form "ibm,plpks-sb-v<version>", or
27 "ibm,plpks-sb-unknown" if there is no SB_VERSION variable.
29 What: /sys/firmware/secvar/vars/<variable name>
31 Contact: Nayna Jain <nayna@linux.ibm.com>
32 Description: Each secure variable is represented as a directory named as
33 <variable_name>. The variable name is unique and is in ASCII
34 representation. The data and size can be determined by reading
35 their respective attribute files.
37 What: /sys/firmware/secvar/vars/<variable_name>/size
39 Contact: Nayna Jain <nayna@linux.ibm.com>
40 Description: An integer representation of the size of the content of the
41 variable. In other words, it represents the size of the data.
43 What: /sys/firmware/secvar/vars/<variable_name>/data
45 Contact: Nayna Jain <nayna@linux.ibm.com>
46 Description: A read-only file containing the value of the variable. The size
47 of the file represents the maximum size of the variable data.
49 What: /sys/firmware/secvar/vars/<variable_name>/update
51 Contact: Nayna Jain <nayna@linux.ibm.com>
52 Description: A write-only file that is used to submit the new value for the
53 variable. The size of the file represents the maximum size of
54 the variable data that can be written.
56 What: /sys/firmware/secvar/config
58 Contact: Nayna Jain <nayna@linux.ibm.com>
59 Description: This optional directory contains read-only config attributes as
60 defined by the secure variable implementation. All data is in
61 ASCII format. The directory is only created if the backing
62 implementation provides variables to populate it, which at
63 present is only PLPKS on the pseries platform.
65 What: /sys/firmware/secvar/config/version
67 Contact: Nayna Jain <nayna@linux.ibm.com>
68 Description: Config version as reported by the hypervisor in ASCII decimal
71 Currently only provided by PLPKS on the pseries platform.
73 What: /sys/firmware/secvar/config/max_object_size
75 Contact: Nayna Jain <nayna@linux.ibm.com>
76 Description: Maximum allowed size of objects in the keystore in bytes,
77 represented in ASCII decimal format.
79 This is not necessarily the same as the max size that can be
80 written to an update file as writes can contain more than
81 object data, you should use the size of the update file for
84 Currently only provided by PLPKS on the pseries platform.
86 What: /sys/firmware/secvar/config/total_size
88 Contact: Nayna Jain <nayna@linux.ibm.com>
89 Description: Total size of the PLPKS in bytes, represented in ASCII decimal
92 Currently only provided by PLPKS on the pseries platform.
94 What: /sys/firmware/secvar/config/used_space
96 Contact: Nayna Jain <nayna@linux.ibm.com>
97 Description: Current space consumed by the key store, in bytes, represented
98 in ASCII decimal format.
100 Currently only provided by PLPKS on the pseries platform.
102 What: /sys/firmware/secvar/config/supported_policies
104 Contact: Nayna Jain <nayna@linux.ibm.com>
105 Description: Bitmask of supported policy flags by the hypervisor,
106 represented as an 8 byte hexadecimal ASCII string. Consult the
107 hypervisor documentation for what these flags are.
109 Currently only provided by PLPKS on the pseries platform.
111 What: /sys/firmware/secvar/config/signed_update_algorithms
113 Contact: Nayna Jain <nayna@linux.ibm.com>
114 Description: Bitmask of flags indicating which algorithms the hypervisor
115 supports for signed update of objects, represented as a 16 byte
116 hexadecimal ASCII string. Consult the hypervisor documentation
117 for what these flags mean.
119 Currently only provided by PLPKS on the pseries platform.