494 lines · plain
1What: /sys/class/firmware-attributes/*/attributes/*/2Date: February 20213KernelVersion: 5.114Contact: Divya Bharathi <Divya.Bharathi@Dell.com>,5 Prasanth KSR <prasanth.ksr@dell.com>6 Dell.Client.Kernel@dell.com7Description:8 A sysfs interface for systems management software to enable9 configuration capability on supported systems. This directory10 exposes interfaces for interacting with configuration options.11 12 Unless otherwise specified in an attribute description all attributes are optional13 and will accept UTF-8 input.14 15 type:16 A file that can be read to obtain the type of attribute.17 This attribute is mandatory.18 19 The following are known types:20 21 - enumeration: a set of pre-defined valid values22 - integer: a range of numerical values23 - string24 25 HP specific types26 -----------------27 - ordered-list - a set of ordered list valid values28 29 30 All attribute types support the following values:31 32 current_value:33 A file that can be read to obtain the current34 value of the <attr>.35 36 This file can also be written to in order to update the value of a37 <attr>38 39 This attribute is mandatory.40 41 default_value:42 A file that can be read to obtain the default43 value of the <attr>44 45 display_name:46 A file that can be read to obtain a user friendly47 description of the at <attr>48 49 display_name_language_code:50 A file that can be read to obtain51 the IETF language tag corresponding to the52 "display_name" of the <attr>53 54 "enumeration"-type specific properties:55 56 possible_values:57 A file that can be read to obtain the possible58 values of the <attr>. Values are separated using59 semi-colon (``;``).60 61 "integer"-type specific properties:62 63 min_value:64 A file that can be read to obtain the lower65 bound value of the <attr>66 67 max_value:68 A file that can be read to obtain the upper69 bound value of the <attr>70 71 scalar_increment:72 A file that can be read to obtain the scalar value used for73 increments of current_value this attribute accepts.74 75 "string"-type specific properties:76 77 max_length:78 A file that can be read to obtain the maximum79 length value of the <attr>80 81 min_length:82 A file that can be read to obtain the minimum83 length value of the <attr>84 85 Dell specific class extensions86 ------------------------------87 88 On Dell systems the following additional attributes are available:89 90 dell_modifier:91 A file that can be read to obtain attribute-level92 dependency rule. It says an attribute X will become read-only or93 suppressed, if/if-not attribute Y is configured.94 95 modifier rules can be in following format::96 97 [ReadOnlyIf:<attribute>=<value>]98 [ReadOnlyIfNot:<attribute>=<value>]99 [SuppressIf:<attribute>=<value>]100 [SuppressIfNot:<attribute>=<value>]101 102 For example::103 104 AutoOnFri/dell_modifier has value,105 [SuppressIfNot:AutoOn=SelectDays]106 107 This means AutoOnFri will be suppressed in BIOS setup if AutoOn108 attribute is not "SelectDays" and its value will not be effective109 through sysfs until this rule is met.110 111 Enumeration attributes also support the following:112 113 dell_value_modifier:114 A file that can be read to obtain value-level dependency.115 This file is similar to dell_modifier but here, an116 attribute's current value will be forcefully changed based117 dependent attributes value.118 119 dell_value_modifier rules can be in following format::120 121 <value>[ForceIf:<attribute>=<value>]122 <value>[ForceIfNot:<attribute>=<value>]123 124 For example::125 126 LegacyOrom/dell_value_modifier has value:127 Disabled[ForceIf:SecureBoot=Enabled]128 129 This means LegacyOrom's current value will be forced to130 "Disabled" in BIOS setup if SecureBoot is Enabled and its131 value will not be effective through sysfs until this rule is132 met.133 134 HP specific class extensions135 ------------------------------136 137 On HP systems the following additional attributes are available:138 139 "ordered-list"-type specific properties:140 141 elements:142 A file that can be read to obtain the possible143 list of values of the <attr>. Values are separated using144 semi-colon (``;``) and listed according to their priority.145 An element listed first has the highest priority. Writing146 the list in a different order to current_value alters147 the priority order for the particular attribute.148 149What: /sys/class/firmware-attributes/*/authentication/150Date: February 2021151KernelVersion: 5.11152Contact: Divya Bharathi <Divya.Bharathi@Dell.com>,153 Prasanth KSR <prasanth.ksr@dell.com>154 Dell.Client.Kernel@dell.com155Description:156 Devices support various authentication mechanisms which can be exposed157 as a separate configuration object.158 159 For example a "BIOS Admin" password and "System" Password can be set,160 reset or cleared using these attributes.161 162 - An "Admin" password is used for preventing modification to the BIOS163 settings.164 - A "System" password is required to boot a machine.165 166 Change in any of these two authentication methods will also generate an167 uevent KOBJ_CHANGE.168 169 is_enabled:170 A file that can be read to obtain a 0/1 flag to see if171 <attr> authentication is enabled.172 This attribute is mandatory.173 174 role:175 The type of authentication used.176 This attribute is mandatory.177 178 Known types:179 bios-admin:180 Representing BIOS administrator password181 power-on:182 Representing a password required to use183 the system184 system-mgmt:185 Representing System Management password.186 See Lenovo extensions section for details187 HDD:188 Representing HDD password189 See Lenovo extensions section for details190 NVMe:191 Representing NVMe password192 See Lenovo extensions section for details193 194 mechanism:195 The means of authentication. This attribute is mandatory.196 Only supported type currently is "password".197 198 max_password_length:199 A file that can be read to obtain the200 maximum length of the Password201 202 min_password_length:203 A file that can be read to obtain the204 minimum length of the Password205 206 current_password:207 A write only value used for privileged access such as208 setting attributes when a system or admin password is set209 or resetting to a new password210 211 This attribute is mandatory when mechanism == "password".212 213 new_password:214 A write only value that when used in tandem with215 current_password will reset a system or admin password.216 217 Note, password management is session specific. If Admin password is set,218 same password must be written into current_password file (required for219 password-validation) and must be cleared once the session is over.220 For example::221 222 echo "password" > current_password223 echo "disabled" > TouchScreen/current_value224 echo "" > current_password225 226 Drivers may emit a CHANGE uevent when a password is set or unset227 userspace may check it again.228 229 On Dell, Lenovo and HP systems, if Admin password is set, then all BIOS attributes230 require password validation.231 On Lenovo systems if you change the Admin password the new password is not active until232 the next boot.233 234 Lenovo specific class extensions235 --------------------------------236 237 On Lenovo systems the following additional settings are available:238 239 role: system-mgmt This gives the same authority as the bios-admin password to control240 security related features. The authorities allocated can be set via241 the BIOS menu SMP Access Control Policy242 243 role: HDD & NVMe This password is used to unlock access to the drive at boot. Note see244 'level' and 'index' extensions below.245 246 lenovo_encoding:247 The encoding method that is used. This can be either "ascii"248 or "scancode". Default is set to "ascii"249 250 lenovo_kbdlang:251 The keyboard language method that is used. This is generally a252 two char code (e.g. "us", "fr", "gr") and may vary per platform.253 Default is set to "us"254 255 level:256 Available for HDD and NVMe authentication to set 'user' or 'master'257 privilege level.258 If only the user password is configured then this should be used to259 unlock the drive at boot. If both master and user passwords are set260 then either can be used. If a master password is set a user password261 is required.262 This attribute defaults to 'user' level263 264 index:265 Used with HDD and NVME authentication to set the drive index266 that is being referenced (e.g hdd1, hdd2 etc)267 This attribute defaults to device 1.268 269 certificate, signature, save_signature:270 These attributes are used for certificate based authentication. This is271 used in conjunction with a signing server as an alternative to password272 based authentication.273 The user writes to the attribute(s) with a BASE64 encoded string obtained274 from the signing server.275 The attributes can be displayed to check the stored value.276 277 Some usage examples:278 279 Installing a certificate to enable feature::280 281 echo "supervisor password" > authentication/Admin/current_password282 echo "signed certificate" > authentication/Admin/certificate283 284 Updating the installed certificate::285 286 echo "signature" > authentication/Admin/signature287 echo "signed certificate" > authentication/Admin/certificate288 289 Removing the installed certificate::290 291 echo "signature" > authentication/Admin/signature292 echo "" > authentication/Admin/certificate293 294 Changing a BIOS setting::295 296 echo "signature" > authentication/Admin/signature297 echo "save signature" > authentication/Admin/save_signature298 echo Enable > attribute/PasswordBeep/current_value299 300 You cannot enable certificate authentication if a supervisor password301 has not been set.302 Clearing the certificate results in no bios-admin authentication method303 being configured allowing anyone to make changes.304 After any of these operations the system must reboot for the changes to305 take effect.306 307 certificate_thumbprint:308 Read only attribute used to display the MD5, SHA1 and SHA256 thumbprints309 for the certificate installed in the BIOS.310 311 certificate_to_password:312 Write only attribute used to switch from certificate based authentication313 back to password based.314 Usage::315 316 echo "signature" > authentication/Admin/signature317 echo "password" > authentication/Admin/certificate_to_password318 319 HP specific class extensions320 --------------------------------321 322 On HP systems the following additional settings are available:323 324 role: enhanced-bios-auth:325 This role is specific to Secure Platform Management (SPM) attribute.326 It requires configuring an endorsement (kek) and signing certificate (sk).327 328 329What: /sys/class/firmware-attributes/*/attributes/pending_reboot330Date: February 2021331KernelVersion: 5.11332Contact: Divya Bharathi <Divya.Bharathi@Dell.com>,333 Prasanth KSR <prasanth.ksr@dell.com>334 Dell.Client.Kernel@dell.com335Description:336 A read-only attribute reads 1 if a reboot is necessary to apply337 pending BIOS attribute changes. Also, an uevent_KOBJ_CHANGE is338 generated when it changes to 1.339 340 == =========================================341 0 All BIOS attributes setting are current342 1 A reboot is necessary to get pending BIOS343 attribute changes applied344 == =========================================345 346 Note, userspace applications need to follow below steps for efficient347 BIOS management,348 349 1. Check if admin password is set. If yes, follow session method for350 password management as briefed under authentication section above.351 2. Before setting any attribute, check if it has any modifiers352 or value_modifiers. If yes, incorporate them and then modify353 attribute.354 355 Drivers may emit a CHANGE uevent when this value changes and userspace356 may check it again.357 358What: /sys/class/firmware-attributes/*/attributes/reset_bios359Date: February 2021360KernelVersion: 5.11361Contact: Divya Bharathi <Divya.Bharathi@Dell.com>,362 Prasanth KSR <prasanth.ksr@dell.com>363 Dell.Client.Kernel@dell.com364Description:365 This attribute can be used to reset the BIOS Configuration.366 Specifically, it tells which type of reset BIOS configuration is being367 requested on the host.368 369 Reading from it returns a list of supported options encoded as:370 371 - 'builtinsafe' (Built in safe configuration profile)372 - 'lastknowngood' (Last known good saved configuration profile)373 - 'factory' (Default factory settings configuration profile)374 - 'custom' (Custom saved configuration profile)375 376 The currently selected option is printed in square brackets as377 shown below::378 379 # echo "factory" > /sys/class/firmware-attributes/*/device/attributes/reset_bios380 # cat /sys/class/firmware-attributes/*/device/attributes/reset_bios381 builtinsafe lastknowngood [factory] custom382 383 Note that any changes to this attribute requires a reboot384 for changes to take effect.385 386What: /sys/class/firmware-attributes/*/attributes/save_settings387Date: August 2023388KernelVersion: 6.6389Contact: Mark Pearson <mpearson-lenovo@squebb.ca>390Description:391 On Lenovo platforms there is a limitation in the number of times an attribute can be392 saved. This is an architectural limitation and it limits the number of attributes393 that can be modified to 48.394 A solution for this is instead of the attribute being saved after every modification,395 to allow a user to bulk set the attributes, and then trigger a final save. This allows396 unlimited attributes.397 398 Read the attribute to check what save mode is enabled (single or bulk).399 E.g:400 # cat /sys/class/firmware-attributes/thinklmi/attributes/save_settings401 single402 403 Write the attribute with 'bulk' to enable bulk save mode.404 Write the attribute with 'single' to enable saving, after every attribute set.405 The default setting is single mode.406 E.g:407 # echo bulk > /sys/class/firmware-attributes/thinklmi/attributes/save_settings408 409 When in bulk mode write 'save' to trigger a save of all currently modified attributes.410 Note, once a save has been triggered, in bulk mode, attributes can no longer be set and411 will return a permissions error. This is to prevent users hitting the 48+ save limitation412 (which requires entering the BIOS to clear the error condition)413 E.g:414 # echo save > /sys/class/firmware-attributes/thinklmi/attributes/save_settings415 416What: /sys/class/firmware-attributes/*/attributes/debug_cmd417Date: July 2021418KernelVersion: 5.14419Contact: Mark Pearson <markpearson@lenovo.com>420Description:421 This write only attribute can be used to send debug commands to the BIOS.422 This should only be used when recommended by the BIOS vendor. Vendors may423 use it to enable extra debug attributes or BIOS features for testing purposes.424 425 Note that any changes to this attribute requires a reboot for changes to take effect.426 427 428 HP specific class extensions - Secure Platform Manager (SPM)429 --------------------------------430 431What: /sys/class/firmware-attributes/*/authentication/SPM/kek432Date: March 2023433KernelVersion: 5.18434Contact: "Jorge Lopez" <jorge.lopez2@hp.com>435Description:436 'kek' Key-Encryption-Key is a write-only file that can be used to configure the437 RSA public key that will be used by the BIOS to verify438 signatures when setting the signing key. When written,439 the bytes should correspond to the KEK certificate440 (x509 .DER format containing an OU). The size of the441 certificate must be less than or equal to 4095 bytes.442 443What: /sys/class/firmware-attributes/*/authentication/SPM/sk444Date: March 2023445KernelVersion: 5.18446Contact: "Jorge Lopez" <jorge.lopez2@hp.com>447Description:448 'sk' Signature Key is a write-only file that can be used to configure the RSA449 public key that will be used by the BIOS to verify signatures450 when configuring BIOS settings and security features. When451 written, the bytes should correspond to the modulus of the452 public key. The exponent is assumed to be 0x10001.453 454What: /sys/class/firmware-attributes/*/authentication/SPM/status455Date: March 2023456KernelVersion: 5.18457Contact: "Jorge Lopez" <jorge.lopez2@hp.com>458Description:459 'status' is a read-only file that returns ASCII text in JSON format reporting460 the status information.461 462 "State": "not provisioned | provisioned | provisioning in progress",463 "Version": "Major.Minor",464 "Nonce": <16-bit unsigned number display in base 10>,465 "FeaturesInUse": <16-bit unsigned number display in base 10>,466 "EndorsementKeyMod": "<256 bytes in base64>",467 "SigningKeyMod": "<256 bytes in base64>"468 469What: /sys/class/firmware-attributes/*/attributes/Sure_Start/audit_log_entries470Date: March 2023471KernelVersion: 5.18472Contact: "Jorge Lopez" <jorge.lopez2@hp.com>473Description:474 'audit_log_entries' is a read-only file that returns the events in the log.475 476 Audit log entry format477 478 Byte 0-15: Requested Audit Log entry (Each Audit log is 16 bytes)479 Byte 16-127: Unused480 481What: /sys/class/firmware-attributes/*/attributes/Sure_Start/audit_log_entry_count482Date: March 2023483KernelVersion: 5.18484Contact: "Jorge Lopez" <jorge.lopez2@hp.com>485Description:486 'audit_log_entry_count' is a read-only file that returns the number of existing487 audit log events available to be read. Values are separated using comma. (``,``)488 489 [No of entries],[log entry size],[Max number of entries supported]490 491 log entry size identifies audit log size for the current BIOS version.492 The current size is 16 bytes but it can be up to 128 bytes long in future BIOS493 versions.494