1What: /sys/firmware/secvar 2Date: August 2019 3Contact: Nayna Jain <nayna@linux.ibm.com> 4Description: This directory is created if the POWER firmware supports OS 5 secureboot, thereby secure variables. It exposes interface 6 for reading/writing the secure variables 7 8What: /sys/firmware/secvar/vars 9Date: August 2019 10Contact: Nayna Jain <nayna@linux.ibm.com> 11Description: This directory lists all the secure variables that are supported 12 by the firmware. 13 14What: /sys/firmware/secvar/format 15Date: August 2019 16Contact: Nayna Jain <nayna@linux.ibm.com> 17Description: A string indicating which backend is in use by the firmware. 18 This determines the format of the variable and the accepted 19 format of variable updates. 20 21 On powernv/OPAL, this value is provided by the OPAL firmware 22 and is expected to be "ibm,edk2-compat-v1". 23 24 On pseries/PLPKS, this is generated by the kernel based on the 25 version number in the SB_VERSION variable in the keystore. The 26 version numbering in the SB_VERSION variable starts from 1. The 27 format string takes the form "ibm,plpks-sb-v<version>" in the 28 case of dynamic key management mode. If the SB_VERSION variable 29 does not exist (or there is an error while reading it), it takes 30 the form "ibm,plpks-sb-v0", indicating that the key management 31 mode is static. 32 33What: /sys/firmware/secvar/vars/<variable name> 34Date: August 2019 35Contact: Nayna Jain <nayna@linux.ibm.com> 36Description: Each secure variable is represented as a directory named as 37 <variable_name>. The variable name is unique and is in ASCII 38 representation. The data and size can be determined by reading 39 their respective attribute files. 40 41What: /sys/firmware/secvar/vars/<variable_name>/size 42Date: August 2019 43Contact: Nayna Jain <nayna@linux.ibm.com> 44Description: An integer representation of the size of the content of the 45 variable. In other words, it represents the size of the data. 46 47What: /sys/firmware/secvar/vars/<variable_name>/data 48Date: August 2019 49Contact: Nayna Jain <nayna@linux.ibm.com> 50Description: A read-only file containing the value of the variable. The size 51 of the file represents the maximum size of the variable data. 52 53What: /sys/firmware/secvar/vars/<variable_name>/update 54Date: August 2019 55Contact: Nayna Jain <nayna@linux.ibm.com> 56Description: A write-only file that is used to submit the new value for the 57 variable. The size of the file represents the maximum size of 58 the variable data that can be written. 59 60What: /sys/firmware/secvar/config 61Date: February 2023 62Contact: Nayna Jain <nayna@linux.ibm.com> 63Description: This optional directory contains read-only config attributes as 64 defined by the secure variable implementation. All data is in 65 ASCII format. The directory is only created if the backing 66 implementation provides variables to populate it, which at 67 present is only PLPKS on the pseries platform. 68 69What: /sys/firmware/secvar/config/version 70Date: February 2023 71Contact: Nayna Jain <nayna@linux.ibm.com> 72Description: Config version as reported by the hypervisor in ASCII decimal 73 format. 74 75 Currently only provided by PLPKS on the pseries platform. 76 77What: /sys/firmware/secvar/config/max_object_size 78Date: February 2023 79Contact: Nayna Jain <nayna@linux.ibm.com> 80Description: Maximum allowed size of objects in the keystore in bytes, 81 represented in ASCII decimal format. 82 83 This is not necessarily the same as the max size that can be 84 written to an update file as writes can contain more than 85 object data, you should use the size of the update file for 86 that purpose. 87 88 Currently only provided by PLPKS on the pseries platform. 89 90What: /sys/firmware/secvar/config/total_size 91Date: February 2023 92Contact: Nayna Jain <nayna@linux.ibm.com> 93Description: Total size of the PLPKS in bytes, represented in ASCII decimal 94 format. 95 96 Currently only provided by PLPKS on the pseries platform. 97 98What: /sys/firmware/secvar/config/used_space 99Date: February 2023 100Contact: Nayna Jain <nayna@linux.ibm.com> 101Description: Current space consumed by the key store, in bytes, represented 102 in ASCII decimal format. 103 104 Currently only provided by PLPKS on the pseries platform. 105 106What: /sys/firmware/secvar/config/supported_policies 107Date: February 2023 108Contact: Nayna Jain <nayna@linux.ibm.com> 109Description: Bitmask of supported policy flags by the hypervisor, 110 represented as an 8 byte hexadecimal ASCII string. Consult the 111 hypervisor documentation for what these flags are. 112 113 Currently only provided by PLPKS on the pseries platform. 114 115What: /sys/firmware/secvar/config/signed_update_algorithms 116Date: February 2023 117Contact: Nayna Jain <nayna@linux.ibm.com> 118Description: Bitmask of flags indicating which algorithms the hypervisor 119 supports for signed update of objects, represented as a 16 byte 120 hexadecimal ASCII string. Consult the hypervisor documentation 121 for what these flags mean. 122 123 Currently only provided by PLPKS on the pseries platform. 124