1 What: /sys/firmware/secvar 1 What: /sys/firmware/secvar
2 Date: August 2019 2 Date: August 2019
3 Contact: Nayna Jain <nayna@linux.ibm.com 3 Contact: Nayna Jain <nayna@linux.ibm.com>
4 Description: This directory is created if t 4 Description: This directory is created if the POWER firmware supports OS
5 secureboot, thereby secure var 5 secureboot, thereby secure variables. It exposes interface
6 for reading/writing the secure 6 for reading/writing the secure variables
7 7
8 What: /sys/firmware/secvar/vars 8 What: /sys/firmware/secvar/vars
9 Date: August 2019 9 Date: August 2019
10 Contact: Nayna Jain <nayna@linux.ibm.com 10 Contact: Nayna Jain <nayna@linux.ibm.com>
11 Description: This directory lists all the s 11 Description: This directory lists all the secure variables that are supported
12 by the firmware. 12 by the firmware.
13 13
14 What: /sys/firmware/secvar/format 14 What: /sys/firmware/secvar/format
15 Date: August 2019 15 Date: August 2019
16 Contact: Nayna Jain <nayna@linux.ibm.com 16 Contact: Nayna Jain <nayna@linux.ibm.com>
17 Description: A string indicating which back 17 Description: A string indicating which backend is in use by the firmware.
18 This determines the format of 18 This determines the format of the variable and the accepted
19 format of variable updates. 19 format of variable updates.
20 20
21 On powernv/OPAL, this value is 21 On powernv/OPAL, this value is provided by the OPAL firmware
22 and is expected to be "ibm,edk 22 and is expected to be "ibm,edk2-compat-v1".
23 23
24 On pseries/PLPKS, this is gene 24 On pseries/PLPKS, this is generated by the kernel based on the
25 version number in the SB_VERSI 25 version number in the SB_VERSION variable in the keystore, and
26 has the form "ibm,plpks-sb-v<v 26 has the form "ibm,plpks-sb-v<version>", or
27 "ibm,plpks-sb-unknown" if ther 27 "ibm,plpks-sb-unknown" if there is no SB_VERSION variable.
28 28
29 What: /sys/firmware/secvar/vars/<var 29 What: /sys/firmware/secvar/vars/<variable name>
30 Date: August 2019 30 Date: August 2019
31 Contact: Nayna Jain <nayna@linux.ibm.com 31 Contact: Nayna Jain <nayna@linux.ibm.com>
32 Description: Each secure variable is repres 32 Description: Each secure variable is represented as a directory named as
33 <variable_name>. The variable 33 <variable_name>. The variable name is unique and is in ASCII
34 representation. The data and s 34 representation. The data and size can be determined by reading
35 their respective attribute fil 35 their respective attribute files.
36 36
37 What: /sys/firmware/secvar/vars/<var 37 What: /sys/firmware/secvar/vars/<variable_name>/size
38 Date: August 2019 38 Date: August 2019
39 Contact: Nayna Jain <nayna@linux.ibm.com 39 Contact: Nayna Jain <nayna@linux.ibm.com>
40 Description: An integer representation of t 40 Description: An integer representation of the size of the content of the
41 variable. In other words, it r 41 variable. In other words, it represents the size of the data.
42 42
43 What: /sys/firmware/secvar/vars/<var 43 What: /sys/firmware/secvar/vars/<variable_name>/data
44 Date: August 2019 44 Date: August 2019
45 Contact: Nayna Jain <nayna@linux.ibm.com 45 Contact: Nayna Jain <nayna@linux.ibm.com>
46 Description: A read-only file containing th 46 Description: A read-only file containing the value of the variable. The size
47 of the file represents the max 47 of the file represents the maximum size of the variable data.
48 48
49 What: /sys/firmware/secvar/vars/<var 49 What: /sys/firmware/secvar/vars/<variable_name>/update
50 Date: August 2019 50 Date: August 2019
51 Contact: Nayna Jain <nayna@linux.ibm.com 51 Contact: Nayna Jain <nayna@linux.ibm.com>
52 Description: A write-only file that is used 52 Description: A write-only file that is used to submit the new value for the
53 variable. The size of the file 53 variable. The size of the file represents the maximum size of
54 the variable data that can be 54 the variable data that can be written.
55 55
56 What: /sys/firmware/secvar/config 56 What: /sys/firmware/secvar/config
57 Date: February 2023 57 Date: February 2023
58 Contact: Nayna Jain <nayna@linux.ibm.com 58 Contact: Nayna Jain <nayna@linux.ibm.com>
59 Description: This optional directory contai 59 Description: This optional directory contains read-only config attributes as
60 defined by the secure variable 60 defined by the secure variable implementation. All data is in
61 ASCII format. The directory is 61 ASCII format. The directory is only created if the backing
62 implementation provides variab 62 implementation provides variables to populate it, which at
63 present is only PLPKS on the p 63 present is only PLPKS on the pseries platform.
64 64
65 What: /sys/firmware/secvar/config/ve 65 What: /sys/firmware/secvar/config/version
66 Date: February 2023 66 Date: February 2023
67 Contact: Nayna Jain <nayna@linux.ibm.com 67 Contact: Nayna Jain <nayna@linux.ibm.com>
68 Description: Config version as reported by 68 Description: Config version as reported by the hypervisor in ASCII decimal
69 format. 69 format.
70 70
71 Currently only provided by PLP 71 Currently only provided by PLPKS on the pseries platform.
72 72
73 What: /sys/firmware/secvar/config/ma 73 What: /sys/firmware/secvar/config/max_object_size
74 Date: February 2023 74 Date: February 2023
75 Contact: Nayna Jain <nayna@linux.ibm.com 75 Contact: Nayna Jain <nayna@linux.ibm.com>
76 Description: Maximum allowed size of object 76 Description: Maximum allowed size of objects in the keystore in bytes,
77 represented in ASCII decimal f 77 represented in ASCII decimal format.
78 78
79 This is not necessarily the sa 79 This is not necessarily the same as the max size that can be
80 written to an update file as w 80 written to an update file as writes can contain more than
81 object data, you should use th 81 object data, you should use the size of the update file for
82 that purpose. 82 that purpose.
83 83
84 Currently only provided by PLP 84 Currently only provided by PLPKS on the pseries platform.
85 85
86 What: /sys/firmware/secvar/config/to 86 What: /sys/firmware/secvar/config/total_size
87 Date: February 2023 87 Date: February 2023
88 Contact: Nayna Jain <nayna@linux.ibm.com 88 Contact: Nayna Jain <nayna@linux.ibm.com>
89 Description: Total size of the PLPKS in byt 89 Description: Total size of the PLPKS in bytes, represented in ASCII decimal
90 format. 90 format.
91 91
92 Currently only provided by PLP 92 Currently only provided by PLPKS on the pseries platform.
93 93
94 What: /sys/firmware/secvar/config/us 94 What: /sys/firmware/secvar/config/used_space
95 Date: February 2023 95 Date: February 2023
96 Contact: Nayna Jain <nayna@linux.ibm.com 96 Contact: Nayna Jain <nayna@linux.ibm.com>
97 Description: Current space consumed by the 97 Description: Current space consumed by the key store, in bytes, represented
98 in ASCII decimal format. 98 in ASCII decimal format.
99 99
100 Currently only provided by PLP 100 Currently only provided by PLPKS on the pseries platform.
101 101
102 What: /sys/firmware/secvar/config/su 102 What: /sys/firmware/secvar/config/supported_policies
103 Date: February 2023 103 Date: February 2023
104 Contact: Nayna Jain <nayna@linux.ibm.com 104 Contact: Nayna Jain <nayna@linux.ibm.com>
105 Description: Bitmask of supported policy fl 105 Description: Bitmask of supported policy flags by the hypervisor,
106 represented as an 8 byte hexad 106 represented as an 8 byte hexadecimal ASCII string. Consult the
107 hypervisor documentation for w 107 hypervisor documentation for what these flags are.
108 108
109 Currently only provided by PLP 109 Currently only provided by PLPKS on the pseries platform.
110 110
111 What: /sys/firmware/secvar/config/si 111 What: /sys/firmware/secvar/config/signed_update_algorithms
112 Date: February 2023 112 Date: February 2023
113 Contact: Nayna Jain <nayna@linux.ibm.com 113 Contact: Nayna Jain <nayna@linux.ibm.com>
114 Description: Bitmask of flags indicating wh 114 Description: Bitmask of flags indicating which algorithms the hypervisor
115 supports for signed update of 115 supports for signed update of objects, represented as a 16 byte
116 hexadecimal ASCII string. Cons 116 hexadecimal ASCII string. Consult the hypervisor documentation
117 for what these flags mean. 117 for what these flags mean.
118 118
119 Currently only provided by PLP 119 Currently only provided by PLPKS on the pseries platform.
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.