Skip to contentSkip to conversation

efi: get rid of deprecated sysfs varstore interface

RFC PATCH In review Ard Biesheuvel 3 participants 7 messages Jun 16, 2022 – Jun 24, 2022

Subsystems (6)
Documentation Arm (32-bit) x86 Kselftest +2 more subsystems
lore
Share & tools
lore

Ard Biesheuvel

author maintainer
#0 lore raw

cover efi: get rid of deprecated sysfs varstore interface

EFI still has two ways of exposing EFI variable to user space: the original sysfs interface and the efivarfs pseudo-filesystem that supersedes it, and which was introduced almost 10 years ago.

As a preparatory step towards refactoring the underlying infrastructure shared between efivarfs and efi-pstore, I would like to finally get rid of the sysfs interface which also uses that, but which is only enabled on x86 and Itanium.

Cc Matthew Garrett <[email protected]>
Cc Peter Jones <[email protected]>
Cc Tony Luck <[email protected]>
Cc Kees Cook <[email protected]>
Cc Thomas Gleixner <[email protected]>
Cc Ingo Molnar <[email protected]>
Cc Borislav Petkov <[email protected]>
Cc Dave Hansen <[email protected]>
Cc [email protected]

Ard Biesheuvel (2):
selftests/kexec: remove broken EFI_VARS secure boot fallback check
efi: remove deprecated 'efivars' sysfs interface

 Documentation/x86/x86_64/uefi.rst                 |   2 +-
 arch/arm/configs/milbeaut_m10v_defconfig          |   1 -
 arch/ia64/configs/bigsur_defconfig                |   1 -
 arch/ia64/configs/generic_defconfig               |   1 -
 arch/ia64/configs/gensparse_defconfig             |   1 -
 arch/ia64/configs/tiger_defconfig                 |   1 -
 arch/ia64/configs/zx1_defconfig                   |   1 -
 arch/x86/configs/i386_defconfig                   |   1 -
 arch/x86/configs/x86_64_defconfig                 |   1 -
 drivers/firmware/efi/Kconfig                      |  12 -
 drivers/firmware/efi/Makefile                     |   1 -
 drivers/firmware/efi/efivars.c                    | 671 --------------------
 tools/testing/selftests/kexec/kexec_common_lib.sh |  36 +-
 13 files changed, 3 insertions(+), 727 deletions(-)
 delete mode 100644 drivers/firmware/efi/efivars.c
Signature · 1 line
2.35.1
author maintainer
#1 lore raw

RFC PATCH 1/2 selftests/kexec: remove broken EFI_VARS secure boot fallback check

Commit b433a52aa28733e0 ("selftests/kexec: update get_secureboot_mode") refactored the code that discovers the EFI secure boot mode so it only depends on either the efivars pseudo filesystem or the efivars sysfs interface, but never both.

However, the latter version was not implemented correctly, given the fact that the local 'efi_vars' variable never assumes a value. This means the fallback has been dead code ever since it was introduced.

So let's drop the fallback altogether. The sysfs interface has been deprecated for ~10 years now, and is only enabled on x86 to begin with, so it is time to get rid of it entirely.

Cc Shuah Khan <[email protected]>
Cc Mimi Zohar <[email protected]>
Signed-off-by Ard Biesheuvel <[email protected]>
---
 tools/testing/selftests/kexec/kexec_common_lib.sh | 36 ++------------------
 1 file changed, 2 insertions(+), 34 deletions(-)
tools/testing/selftests/kexec/kexec_common_lib.sh +2 -34
index 0e114b34d5d7..641ef05863b2 100755
@@ -65,32 +65,6 @@ get_efivarfs_secureboot_mode()
 	return 0;
 }
 
-get_efi_var_secureboot_mode()
-{
-	local efi_vars
-	local secure_boot_file
-	local setup_mode_file
-	local secureboot_mode
-	local setup_mode
-
-	if [ ! -d "$efi_vars" ]; then
-		log_skip "efi_vars is not enabled\n"
-	fi
-	secure_boot_file=$(find "$efi_vars" -name SecureBoot-* 2>/dev/null)
-	setup_mode_file=$(find "$efi_vars" -name SetupMode-* 2>/dev/null)
-	if [ -f "$secure_boot_file/data" ] && \
-	   [ -f "$setup_mode_file/data" ]; then
-		secureboot_mode=`od -An -t u1 "$secure_boot_file/data"`
-		setup_mode=`od -An -t u1 "$setup_mode_file/data"`
-
-		if [ $secureboot_mode -eq 1 ] && [ $setup_mode -eq 0 ]; then
-			log_info "secure boot mode enabled (CONFIG_EFI_VARS)"
-			return 1;
-		fi
-	fi
-	return 0;
-}
-
 # On powerpc platform, check device-tree property
 # /proc/device-tree/ibm,secureboot/os-secureboot-enforcing
 # to detect secureboot state.

@@ -113,9 +87,8 @@ get_arch()
 }
 
 # Check efivar SecureBoot-$(the UUID) and SetupMode-$(the UUID).
-# The secure boot mode can be accessed either as the last integer
-# of "od -An -t u1 /sys/firmware/efi/efivars/SecureBoot-*" or from
-# "od -An -t u1 /sys/firmware/efi/vars/SecureBoot-*/data".  The efi
+# The secure boot mode can be accessed as the last integer of
+# "od -An -t u1 /sys/firmware/efi/efivars/SecureBoot-*".  The efi
 # SetupMode can be similarly accessed.
 # Return 1 for SecureBoot mode enabled and SetupMode mode disabled.
 get_secureboot_mode()

@@ -129,11 +102,6 @@ get_secureboot_mode()
 	else
 		get_efivarfs_secureboot_mode
 		secureboot_mode=$?
-		# fallback to using the efi_var files
-		if [ $secureboot_mode -eq 0 ]; then
-			get_efi_var_secureboot_mode
-			secureboot_mode=$?
-		fi
 	fi
 
 	if [ $secureboot_mode -eq 0 ]; then
Signature · 1 line
2.35.1
Reviewed-by on v1 1/2
#2 lore raw

Re: [RFC PATCH 1/2] selftests/kexec: remove broken EFI_VARS secure boot fallback check

Quoted 9 lines · Ard Biesheuvel

Commit b433a52aa28733e0 ("selftests/kexec: update get_secureboot_mode") refactored the code that discovers the EFI secure boot mode so it only depends on either the efivars pseudo filesystem or the efivars sysfs interface, but never both.

However, the latter version was not implemented correctly, given the fact that the local 'efi_vars' variable never assumes a value. This means the fallback has been dead code ever since it was introduced.

Quoted 7 lines

So let's drop the fallback altogether. The sysfs interface has been deprecated for ~10 years now, and is only enabled on x86 to begin with, so it is time to get rid of it entirely.

Cc Shuah Khan <[email protected]>
Cc Mimi Zohar <[email protected]>
Signed-off-by Ard Biesheuvel <[email protected]>

Thanks, Ard.

Reviewed-by Mimi Zohar <[email protected]>
author maintainer
#3 lore raw

Re: [RFC PATCH 1/2] selftests/kexec: remove broken EFI_VARS secure boot fallback check

Quoted 15 lines · Mimi Zohar
Quoted 13 lines · Ard Biesheuvel

Commit b433a52aa28733e0 ("selftests/kexec: update get_secureboot_mode") refactored the code that discovers the EFI secure boot mode so it only depends on either the efivars pseudo filesystem or the efivars sysfs interface, but never both.

However, the latter version was not implemented correctly, given the fact that the local 'efi_vars' variable never assumes a value. This means the fallback has been dead code ever since it was introduced.

So let's drop the fallback altogether. The sysfs interface has been deprecated for ~10 years now, and is only enabled on x86 to begin with, so it is time to get rid of it entirely.

Quoted 8 lines
Quoted 3 lines
Cc Shuah Khan <[email protected]>
Cc Mimi Zohar <[email protected]>
Signed-off-by Ard Biesheuvel <[email protected]>

Thanks, Ard.

Reviewed-by Mimi Zohar <[email protected]>

Thanks Mimi, I've queued this up in efi/next.

author maintainer
#4 lore raw

RFC PATCH 2/2 efi: remove deprecated 'efivars' sysfs interface

In reply to Ard Biesheuvel

Commit 5d9db883761a ("efi: Add support for a UEFI variable filesystem") dated Oct 5, 2012, introduced a new efivarfs pseudo-filesystem to replace the efivars sysfs interface that was used up to that point to expose EFI variables to user space.

The main problem with the sysfs interface was that it only supported up to 1024 bytes of payload per file, whereas the underlying variables themselves are only bounded by a platform specific per-variable and global limit that is typically much higher than 1024 bytes.

The deprecated sysfs interface is only enabled on x86 and Itanium, other EFI enabled architectures only support the efivarfs pseudo-filesystem.

So let's finally rip off the band aid, and drop the old interface entirely. This will make it easier to refactor and clean up the underlying infrastructure that is shared between efivars, efivarfs and efi-pstore, and is long overdue for a makeover.

Signed-off-by Ard Biesheuvel <[email protected]>
---
 Documentation/x86/x86_64/uefi.rst        |   2 +-
 arch/arm/configs/milbeaut_m10v_defconfig |   1 -
 arch/ia64/configs/bigsur_defconfig       |   1 -
 arch/ia64/configs/generic_defconfig      |   1 -
 arch/ia64/configs/gensparse_defconfig    |   1 -
 arch/ia64/configs/tiger_defconfig        |   1 -
 arch/ia64/configs/zx1_defconfig          |   1 -
 arch/x86/configs/i386_defconfig          |   1 -
 arch/x86/configs/x86_64_defconfig        |   1 -
 drivers/firmware/efi/Kconfig             |  12 -
 drivers/firmware/efi/Makefile            |   1 -
 drivers/firmware/efi/efivars.c           | 671 --------------------
 12 files changed, 1 insertion(+), 693 deletions(-)
Documentation/x86/x86_64/uefi.rst +1 -1
index 3b894103a734..fbc30c9a071d 100644
@@ -29,7 +29,7 @@ Mechanics
   be selected::
 
 	CONFIG_EFI=y
-	CONFIG_EFI_VARS=y or m		# optional
+	CONFIG_EFIVAR_FS=y or m		# optional
 
 - Create a VFAT partition on the disk
 - Copy the following to the VFAT partition:
arch/arm/configs/milbeaut_m10v_defconfig +0 -1
index 7c07f9893a0f..9b4789af0201 100644
@@ -44,7 +44,6 @@ CONFIG_ARM_CPUIDLE=y
 CONFIG_VFP=y
 CONFIG_NEON=y
 CONFIG_KERNEL_MODE_NEON=y
-CONFIG_EFI_VARS=m
 CONFIG_EFI_CAPSULE_LOADER=m
 CONFIG_ARM_CRYPTO=y
 CONFIG_CRYPTO_SHA1_ARM_NEON=m
arch/ia64/configs/bigsur_defconfig +0 -1
index 0341a67cc1bf..a3724882295c 100644
@@ -10,7 +10,6 @@ CONFIG_SMP=y
 CONFIG_NR_CPUS=2
 CONFIG_PREEMPT=y
 CONFIG_IA64_PALINFO=y
-CONFIG_EFI_VARS=y
 CONFIG_BINFMT_MISC=m
 CONFIG_ACPI_BUTTON=m
 CONFIG_ACPI_FAN=m
arch/ia64/configs/generic_defconfig +0 -1
index 8916a2850c48..a3dff482a3d7 100644
@@ -21,7 +21,6 @@ CONFIG_IA64_MCA_RECOVERY=y
 CONFIG_IA64_PALINFO=y
 CONFIG_KEXEC=y
 CONFIG_CRASH_DUMP=y
-CONFIG_EFI_VARS=y
 CONFIG_BINFMT_MISC=m
 CONFIG_ACPI_BUTTON=m
 CONFIG_ACPI_FAN=m
arch/ia64/configs/gensparse_defconfig +0 -1
index 281eb9c544f9..4cd46105b020 100644
@@ -18,7 +18,6 @@ CONFIG_HOTPLUG_CPU=y
 CONFIG_SPARSEMEM_MANUAL=y
 CONFIG_IA64_MCA_RECOVERY=y
 CONFIG_IA64_PALINFO=y
-CONFIG_EFI_VARS=y
 CONFIG_BINFMT_MISC=m
 CONFIG_ACPI_BUTTON=m
 CONFIG_ACPI_FAN=m
arch/ia64/configs/tiger_defconfig +0 -1
index b4f9819a1a45..a2045d73adfa 100644
@@ -23,7 +23,6 @@ CONFIG_FORCE_CPEI_RETARGET=y
 CONFIG_IA64_MCA_RECOVERY=y
 CONFIG_IA64_PALINFO=y
 CONFIG_KEXEC=y
-CONFIG_EFI_VARS=y
 CONFIG_BINFMT_MISC=m
 CONFIG_ACPI_BUTTON=m
 CONFIG_ACPI_FAN=m
arch/ia64/configs/zx1_defconfig +0 -1
index 851d8594cdb8..99f8b2a0332b 100644
@@ -12,7 +12,6 @@ CONFIG_FLATMEM_MANUAL=y
 CONFIG_IA64_MCA_RECOVERY=y
 CONFIG_IA64_PALINFO=y
 CONFIG_CRASH_DUMP=y
-CONFIG_EFI_VARS=y
 CONFIG_BINFMT_MISC=y
 CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_ACPI=y
arch/x86/configs/i386_defconfig +0 -1
index 98a4852ed6a0..7207219509f6 100644
@@ -135,7 +135,6 @@ CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_DEBUG_DEVRES=y
 CONFIG_CONNECTOR=y
-CONFIG_EFI_VARS=y
 CONFIG_EFI_CAPSULE_LOADER=y
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_VIRTIO_BLK=y
arch/x86/configs/x86_64_defconfig +0 -1
index 69784505a7a8..5ce67b73e218 100644
@@ -134,7 +134,6 @@ CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_DEBUG_DEVRES=y
 CONFIG_CONNECTOR=y
-CONFIG_EFI_VARS=y
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_VIRTIO_BLK=y
 CONFIG_BLK_DEV_SD=y
drivers/firmware/efi/Kconfig +0 -12
index 7aa4717cdcac..2e6032e26846 100644
@@ -2,18 +2,6 @@
 menu "EFI (Extensible Firmware Interface) Support"
 	depends on EFI
 
-config EFI_VARS
-	tristate "EFI Variable Support via sysfs"
-	depends on EFI && (X86 || IA64)
-	default n
-	help
-	  If you say Y here, you are able to get EFI (Extensible Firmware
-	  Interface) variable information via sysfs.  You may read,
-	  write, create, and destroy EFI variables through this interface.
-	  Note that this driver is only retained for compatibility with
-	  legacy users: new users should use the efivarfs filesystem
-	  instead.
-
 config EFI_ESRT
 	bool
 	depends on EFI && !IA64
drivers/firmware/efi/Makefile +0 -1
index c02ff25dd477..8d151e332584 100644
@@ -17,7 +17,6 @@ ifneq ($(CONFIG_EFI_CAPSULE_LOADER),)
 obj-$(CONFIG_EFI)			+= capsule.o
 endif
 obj-$(CONFIG_EFI_PARAMS_FROM_FDT)	+= fdtparams.o
-obj-$(CONFIG_EFI_VARS)			+= efivars.o
 obj-$(CONFIG_EFI_ESRT)			+= esrt.o
 obj-$(CONFIG_EFI_VARS_PSTORE)		+= efi-pstore.o
 obj-$(CONFIG_UEFI_CPER)			+= cper.o
drivers/firmware/efi/efivars.c deleted +0 -671

671 lines not on this page · raw message

Signature · 1 line
2.35.1
#5 lore raw

Re: [RFC PATCH 2/2] efi: remove deprecated 'efivars' sysfs interface

Quoted 5 lines · Ard Biesheuvel

Commit 5d9db883761a ("efi: Add support for a UEFI variable filesystem") dated Oct 5, 2012, introduced a new efivarfs pseudo-filesystem to replace the efivars sysfs interface that was used up to that point to expose EFI variables to user space.

Quoted 7 lines

The main problem with the sysfs interface was that it only supported up to 1024 bytes of payload per file, whereas the underlying variables themselves are only bounded by a platform specific per-variable and global limit that is typically much higher than 1024 bytes.

The deprecated sysfs interface is only enabled on x86 and Itanium, other EFI enabled architectures only support the efivarfs pseudo-filesystem.

Does anything still use the sysfs interface? (e.g. do paths to it exist in anything meaningful in, say, a Debian code search?)

Signature · 1 line
Kees Cook
author maintainer
#6 lore raw

Re: [RFC PATCH 2/2] efi: remove deprecated 'efivars' sysfs interface

Quoted 12 lines · Kees Cook
Quoted 10 lines · Ard Biesheuvel

Commit 5d9db883761a ("efi: Add support for a UEFI variable filesystem") dated Oct 5, 2012, introduced a new efivarfs pseudo-filesystem to replace the efivars sysfs interface that was used up to that point to expose EFI variables to user space.

The main problem with the sysfs interface was that it only supported up to 1024 bytes of payload per file, whereas the underlying variables themselves are only bounded by a platform specific per-variable and global limit that is typically much higher than 1024 bytes.

Quoted 6 lines
Quoted 2 lines

The deprecated sysfs interface is only enabled on x86 and Itanium, other EFI enabled architectures only support the efivarfs pseudo-filesystem.

Does anything still use the sysfs interface? (e.g. do paths to it exist in anything meaningful in, say, a Debian code search?)

All the hits I get there are in code that refers to /sys/firmware/efi/vars as the 'legacy' path, and also carries a reference to efivarfs. (i.e., /sys/firmware/efi/efivars)