barebox on EFI bios and secure boot

Hi,

I use barebox to boot a linux kernel on an Intel atom based PC with an EFI bios and this just works.

Now I wanted to configure the bios to enable the secure boot mode: this means I tried to write some EFI variables (db, dbx, KEK, PK); for this I used the efitools utils (efi-updatevar for example) but it didn't
worked: I always get an 'Invalid argument' error.

After some unsuccessful tries I booted the linux kernel directly from the bios, without barebox and in this case the efi-updatevar tool worked as expected; so I suppose that starting barebox has some kind of effect on the persistent store for the efi vars.

Does anyone have similar issues or a suggestion about what can be checked to fix this ???

thank you,

giorgio

Hello Giorgio,

In this case, neither barebox or the kernel are signed, right?

I am not familiar with UEFI secure boot, so I don't know if there is some lock down happening here or what could cause this.

Some things to try:

- Are other variables writable?
- Can you write this variable from barebox? wecho -o /efivars/your-variable or memcpy -d /efivars/some-variable

Christian (CC'd) mentioned a while ago that he had a secure booting UEFI system. I asked him on IRC and he mentioned using lockdown.efi for lock down back then.

Hope this helps and let me know how it goes.

Cheers,
Ahmad

Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |