367 lines
12 KiB
Plaintext
367 lines
12 KiB
Plaintext
|
What: /sys/class/firmware-attributes/*/attributes/*/
|
||
|
|
Date: February 2021
|
||
|
|
KernelVersion: 5.11
|
||
|
|
Contact: Divya Bharathi <Divya.Bharathi@Dell.com>,
|
||
|
|
Prasanth KSR <prasanth.ksr@dell.com>
|
||
|
|
Dell.Client.Kernel@dell.com
|
||
|
|
Description:
|
||
|
|
A sysfs interface for systems management software to enable
|
||
|
|
configuration capability on supported systems. This directory
|
||
|
|
exposes interfaces for interacting with configuration options.
|
||
|
|
|
||
|
|
Unless otherwise specified in an attribute description all attributes are optional
|
||
|
|
and will accept UTF-8 input.
|
||
|
|
|
||
|
|
type:
|
||
|
|
A file that can be read to obtain the type of attribute.
|
||
|
|
This attribute is mandatory.
|
||
|
|
|
||
|
|
The following are known types:
|
||
|
|
|
||
|
|
- enumeration: a set of pre-defined valid values
|
||
|
|
- integer: a range of numerical values
|
||
|
|
- string
|
||
|
|
|
||
|
|
All attribute types support the following values:
|
||
|
|
|
||
|
|
current_value:
|
||
|
|
A file that can be read to obtain the current
|
||
|
|
value of the <attr>.
|
||
|
|
|
||
|
|
This file can also be written to in order to update the value of a
|
||
|
|
<attr>
|
||
|
|
|
||
|
|
This attribute is mandatory.
|
||
|
|
|
||
|
|
default_value:
|
||
|
|
A file that can be read to obtain the default
|
||
|
|
value of the <attr>
|
||
|
|
|
||
|
|
display_name:
|
||
|
|
A file that can be read to obtain a user friendly
|
||
|
|
description of the at <attr>
|
||
|
|
|
||
|
|
display_name_language_code:
|
||
|
|
A file that can be read to obtain
|
||
|
|
the IETF language tag corresponding to the
|
||
|
|
"display_name" of the <attr>
|
||
|
|
|
||
|
|
"enumeration"-type specific properties:
|
||
|
|
|
||
|
|
possible_values:
|
||
|
|
A file that can be read to obtain the possible
|
||
|
|
values of the <attr>. Values are separated using
|
||
|
|
semi-colon (``;``).
|
||
|
|
|
||
|
|
"integer"-type specific properties:
|
||
|
|
|
||
|
|
min_value:
|
||
|
|
A file that can be read to obtain the lower
|
||
|
|
bound value of the <attr>
|
||
|
|
|
||
|
|
max_value:
|
||
|
|
A file that can be read to obtain the upper
|
||
|
|
bound value of the <attr>
|
||
|
|
|
||
|
|
scalar_increment:
|
||
|
|
A file that can be read to obtain the scalar value used for
|
||
|
|
increments of current_value this attribute accepts.
|
||
|
|
|
||
|
|
"string"-type specific properties:
|
||
|
|
|
||
|
|
max_length:
|
||
|
|
A file that can be read to obtain the maximum
|
||
|
|
length value of the <attr>
|
||
|
|
|
||
|
|
min_length:
|
||
|
|
A file that can be read to obtain the minimum
|
||
|
|
length value of the <attr>
|
||
|
|
|
||
|
|
Dell specific class extensions
|
||
|
|
------------------------------
|
||
|
|
|
||
|
|
On Dell systems the following additional attributes are available:
|
||
|
|
|
||
|
|
dell_modifier:
|
||
|
|
A file that can be read to obtain attribute-level
|
||
|
|
dependency rule. It says an attribute X will become read-only or
|
||
|
|
suppressed, if/if-not attribute Y is configured.
|
||
|
|
|
||
|
|
modifier rules can be in following format::
|
||
|
|
|
||
|
|
[ReadOnlyIf:<attribute>=<value>]
|
||
|
|
[ReadOnlyIfNot:<attribute>=<value>]
|
||
|
|
[SuppressIf:<attribute>=<value>]
|
||
|
|
[SuppressIfNot:<attribute>=<value>]
|
||
|
|
|
||
|
|
For example::
|
||
|
|
|
||
|
|
AutoOnFri/dell_modifier has value,
|
||
|
|
[SuppressIfNot:AutoOn=SelectDays]
|
||
|
|
|
||
|
|
This means AutoOnFri will be suppressed in BIOS setup if AutoOn
|
||
|
|
attribute is not "SelectDays" and its value will not be effective
|
||
|
|
through sysfs until this rule is met.
|
||
|
|
|
||
|
|
Enumeration attributes also support the following:
|
||
|
|
|
||
|
|
dell_value_modifier:
|
||
|
|
A file that can be read to obtain value-level dependency.
|
||
|
|
This file is similar to dell_modifier but here, an
|
||
|
|
attribute's current value will be forcefully changed based
|
||
|
|
dependent attributes value.
|
||
|
|
|
||
|
|
dell_value_modifier rules can be in following format::
|
||
|
|
|
||
|
|
<value>[ForceIf:<attribute>=<value>]
|
||
|
|
<value>[ForceIfNot:<attribute>=<value>]
|
||
|
|
|
||
|
|
For example::
|
||
|
|
|
||
|
|
LegacyOrom/dell_value_modifier has value:
|
||
|
|
Disabled[ForceIf:SecureBoot=Enabled]
|
||
|
|
|
||
|
|
This means LegacyOrom's current value will be forced to
|
||
|
|
"Disabled" in BIOS setup if SecureBoot is Enabled and its
|
||
|
|
value will not be effective through sysfs until this rule is
|
||
|
|
met.
|
||
|
|
|
||
|
|
What: /sys/class/firmware-attributes/*/authentication/
|
||
|
|
Date: February 2021
|
||
|
|
KernelVersion: 5.11
|
||
|
|
Contact: Divya Bharathi <Divya.Bharathi@Dell.com>,
|
||
|
|
Prasanth KSR <prasanth.ksr@dell.com>
|
||
|
|
Dell.Client.Kernel@dell.com
|
||
|
|
Description:
|
||
|
|
Devices support various authentication mechanisms which can be exposed
|
||
|
|
as a separate configuration object.
|
||
|
|
|
||
|
|
For example a "BIOS Admin" password and "System" Password can be set,
|
||
|
|
reset or cleared using these attributes.
|
||
|
|
|
||
|
|
- An "Admin" password is used for preventing modification to the BIOS
|
||
|
|
settings.
|
||
|
|
- A "System" password is required to boot a machine.
|
||
|
|
|
||
|
|
Change in any of these two authentication methods will also generate an
|
||
|
|
uevent KOBJ_CHANGE.
|
||
|
|
|
||
|
|
is_enabled:
|
||
|
|
A file that can be read to obtain a 0/1 flag to see if
|
||
|
|
<attr> authentication is enabled.
|
||
|
|
This attribute is mandatory.
|
||
|
|
|
||
|
|
role:
|
||
|
|
The type of authentication used.
|
||
|
|
This attribute is mandatory.
|
||
|
|
|
||
|
|
Known types:
|
||
|
|
bios-admin:
|
||
|
|
Representing BIOS administrator password
|
||
|
|
power-on:
|
||
|
|
Representing a password required to use
|
||
|
|
the system
|
||
|
|
system-mgmt:
|
||
|
|
Representing System Management password.
|
||
|
|
See Lenovo extensions section for details
|
||
|
|
HDD:
|
||
|
|
Representing HDD password
|
||
|
|
See Lenovo extensions section for details
|
||
|
|
NVMe:
|
||
|
|
Representing NVMe password
|
||
|
|
See Lenovo extensions section for details
|
||
|
|
|
||
|
|
mechanism:
|
||
|
|
The means of authentication. This attribute is mandatory.
|
||
|
|
Only supported type currently is "password".
|
||
|
|
|
||
|
|
max_password_length:
|
||
|
|
A file that can be read to obtain the
|
||
|
|
maximum length of the Password
|
||
|
|
|
||
|
|
min_password_length:
|
||
|
|
A file that can be read to obtain the
|
||
|
|
minimum length of the Password
|
||
|
|
|
||
|
|
current_password:
|
||
|
|
A write only value used for privileged access such as
|
||
|
|
setting attributes when a system or admin password is set
|
||
|
|
or resetting to a new password
|
||
|
|
|
||
|
|
This attribute is mandatory when mechanism == "password".
|
||
|
|
|
||
|
|
new_password:
|
||
|
|
A write only value that when used in tandem with
|
||
|
|
current_password will reset a system or admin password.
|
||
|
|
|
||
|
|
Note, password management is session specific. If Admin password is set,
|
||
|
|
same password must be written into current_password file (required for
|
||
|
|
password-validation) and must be cleared once the session is over.
|
||
|
|
For example::
|
||
|
|
|
||
|
|
echo "password" > current_password
|
||
|
|
echo "disabled" > TouchScreen/current_value
|
||
|
|
echo "" > current_password
|
||
|
|
|
||
|
|
Drivers may emit a CHANGE uevent when a password is set or unset
|
||
|
|
userspace may check it again.
|
||
|
|
|
||
|
|
On Dell and Lenovo systems, if Admin password is set, then all BIOS attributes
|
||
|
|
require password validation.
|
||
|
|
On Lenovo systems if you change the Admin password the new password is not active until
|
||
|
|
the next boot.
|
||
|
|
|
||
|
|
Lenovo specific class extensions
|
||
|
|
--------------------------------
|
||
|
|
|
||
|
|
On Lenovo systems the following additional settings are available:
|
||
|
|
|
||
|
|
role: system-mgmt This gives the same authority as the bios-admin password to control
|
||
|
|
security related features. The authorities allocated can be set via
|
||
|
|
the BIOS menu SMP Access Control Policy
|
||
|
|
|
||
|
|
role: HDD & NVMe This password is used to unlock access to the drive at boot. Note see
|
||
|
|
'level' and 'index' extensions below.
|
||
|
|
|
||
|
|
lenovo_encoding:
|
||
|
|
The encoding method that is used. This can be either "ascii"
|
||
|
|
or "scancode". Default is set to "ascii"
|
||
|
|
|
||
|
|
lenovo_kbdlang:
|
||
|
|
The keyboard language method that is used. This is generally a
|
||
|
|
two char code (e.g. "us", "fr", "gr") and may vary per platform.
|
||
|
|
Default is set to "us"
|
||
|
|
|
||
|
|
level:
|
||
|
|
Available for HDD and NVMe authentication to set 'user' or 'master'
|
||
|
|
privilege level.
|
||
|
|
If only the user password is configured then this should be used to
|
||
|
|
unlock the drive at boot. If both master and user passwords are set
|
||
|
|
then either can be used. If a master password is set a user password
|
||
|
|
is required.
|
||
|
|
This attribute defaults to 'user' level
|
||
|
|
|
||
|
|
index:
|
||
|
|
Used with HDD and NVME authentication to set the drive index
|
||
|
|
that is being referenced (e.g hdd0, hdd1 etc)
|
||
|
|
This attribute defaults to device 0.
|
||
|
|
|
||
|
|
certificate, signature, save_signature:
|
||
|
|
These attributes are used for certificate based authentication. This is
|
||
|
|
used in conjunction with a signing server as an alternative to password
|
||
|
|
based authentication.
|
||
|
|
The user writes to the attribute(s) with a BASE64 encoded string obtained
|
||
|
|
from the signing server.
|
||
|
|
The attributes can be displayed to check the stored value.
|
||
|
|
|
||
|
|
Some usage examples:
|
||
|
|
|
||
|
|
Installing a certificate to enable feature::
|
||
|
|
|
||
|
|
echo "supervisor password" > authentication/Admin/current_password
|
||
|
|
echo "signed certificate" > authentication/Admin/certificate
|
||
|
|
|
||
|
|
Updating the installed certificate::
|
||
|
|
|
||
|
|
echo "signature" > authentication/Admin/signature
|
||
|
|
echo "signed certificate" > authentication/Admin/certificate
|
||
|
|
|
||
|
|
Removing the installed certificate::
|
||
|
|
|
||
|
|
echo "signature" > authentication/Admin/signature
|
||
|
|
echo "" > authentication/Admin/certificate
|
||
|
|
|
||
|
|
Changing a BIOS setting::
|
||
|
|
|
||
|
|
echo "signature" > authentication/Admin/signature
|
||
|
|
echo "save signature" > authentication/Admin/save_signature
|
||
|
|
echo Enable > attribute/PasswordBeep/current_value
|
||
|
|
|
||
|
|
You cannot enable certificate authentication if a supervisor password
|
||
|
|
has not been set.
|
||
|
|
Clearing the certificate results in no bios-admin authentication method
|
||
|
|
being configured allowing anyone to make changes.
|
||
|
|
After any of these operations the system must reboot for the changes to
|
||
|
|
take effect.
|
||
|
|
|
||
|
|
certificate_thumbprint:
|
||
|
|
Read only attribute used to display the MD5, SHA1 and SHA256 thumbprints
|
||
|
|
for the certificate installed in the BIOS.
|
||
|
|
|
||
|
|
certificate_to_password:
|
||
|
|
Write only attribute used to switch from certificate based authentication
|
||
|
|
back to password based.
|
||
|
|
Usage::
|
||
|
|
|
||
|
|
echo "signature" > authentication/Admin/signature
|
||
|
|
echo "password" > authentication/Admin/certificate_to_password
|
||
|
|
|
||
|
|
|
||
|
|
What: /sys/class/firmware-attributes/*/attributes/pending_reboot
|
||
|
|
Date: February 2021
|
||
|
|
KernelVersion: 5.11
|
||
|
|
Contact: Divya Bharathi <Divya.Bharathi@Dell.com>,
|
||
|
|
Prasanth KSR <prasanth.ksr@dell.com>
|
||
|
|
Dell.Client.Kernel@dell.com
|
||
|
|
Description:
|
||
|
|
A read-only attribute reads 1 if a reboot is necessary to apply
|
||
|
|
pending BIOS attribute changes. Also, an uevent_KOBJ_CHANGE is
|
||
|
|
generated when it changes to 1.
|
||
|
|
|
||
|
|
== =========================================
|
||
|
|
0 All BIOS attributes setting are current
|
||
|
|
1 A reboot is necessary to get pending BIOS
|
||
|
|
attribute changes applied
|
||
|
|
== =========================================
|
||
|
|
|
||
|
|
Note, userspace applications need to follow below steps for efficient
|
||
|
|
BIOS management,
|
||
|
|
|
||
|
|
1. Check if admin password is set. If yes, follow session method for
|
||
|
|
password management as briefed under authentication section above.
|
||
|
|
2. Before setting any attribute, check if it has any modifiers
|
||
|
|
or value_modifiers. If yes, incorporate them and then modify
|
||
|
|
attribute.
|
||
|
|
|
||
|
|
Drivers may emit a CHANGE uevent when this value changes and userspace
|
||
|
|
may check it again.
|
||
|
|
|
||
|
|
What: /sys/class/firmware-attributes/*/attributes/reset_bios
|
||
|
|
Date: February 2021
|
||
|
|
KernelVersion: 5.11
|
||
|
|
Contact: Divya Bharathi <Divya.Bharathi@Dell.com>,
|
||
|
|
Prasanth KSR <prasanth.ksr@dell.com>
|
||
|
|
Dell.Client.Kernel@dell.com
|
||
|
|
Description:
|
||
|
|
This attribute can be used to reset the BIOS Configuration.
|
||
|
|
Specifically, it tells which type of reset BIOS configuration is being
|
||
|
|
requested on the host.
|
||
|
|
|
||
|
|
Reading from it returns a list of supported options encoded as:
|
||
|
|
|
||
|
|
- 'builtinsafe' (Built in safe configuration profile)
|
||
|
|
- 'lastknowngood' (Last known good saved configuration profile)
|
||
|
|
- 'factory' (Default factory settings configuration profile)
|
||
|
|
- 'custom' (Custom saved configuration profile)
|
||
|
|
|
||
|
|
The currently selected option is printed in square brackets as
|
||
|
|
shown below::
|
||
|
|
|
||
|
|
# echo "factory" > /sys/class/firmware-attributes/*/device/attributes/reset_bios
|
||
|
|
# cat /sys/class/firmware-attributes/*/device/attributes/reset_bios
|
||
|
|
builtinsafe lastknowngood [factory] custom
|
||
|
|
|
||
|
|
Note that any changes to this attribute requires a reboot
|
||
|
|
for changes to take effect.
|
||
|
|
|
||
|
|
What: /sys/class/firmware-attributes/*/attributes/debug_cmd
|
||
|
|
Date: July 2021
|
||
|
|
KernelVersion: 5.14
|
||
|
|
Contact: Mark Pearson <markpearson@lenovo.com>
|
||
|
|
Description:
|
||
|
|
This write only attribute can be used to send debug commands to the BIOS.
|
||
|
|
This should only be used when recommended by the BIOS vendor. Vendors may
|
||
|
|
use it to enable extra debug attributes or BIOS features for testing purposes.
|
||
|
|
|
||
|
|
Note that any changes to this attribute requires a reboot for changes to take effect.
|