Hello Giorgio, On 08.08.24 11:45, giorgio.nicole@xxxxxxxx wrote: > I use barebox to boot a linux kernel on an Intel atom based PC with an EFI bios and this just works. > > Now I wanted to configure the bios to enable the secure boot mode: this means I tried to write some > EFI variables (db, dbx, KEK, PK); for this I used the efitools utils (efi-updatevar for example) but it didn't > worked: I always get an 'Invalid argument' error. In this case, neither barebox or the kernel are signed, right? > After some unsuccessful tries I booted the linux kernel directly from the bios, without barebox and in this > case the efi-updatevar tool worked as expected; so I suppose that starting barebox has some kind of effect > on the persistent store for the efi vars. I am not familiar with UEFI secure boot, so I don't know if there is some lock down happening here or what could cause this. Some things to try: - Are other variables writable? - Can you write this variable from barebox? wecho -o /efivars/your-variable or memcpy -d /efivars/some-variable > Does anyone have similar issues or a suggestion about what can be checked to fix this ??? Christian (CC'd) mentioned a while ago that he had a secure booting UEFI system. I asked him on IRC and he mentioned using lockdown.efi for lock down back then. Hope this helps and let me know how it goes. Cheers, Ahmad > > thank you, > > giorgio > > > -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
