Hallo Ahmad, thank you for the answer, >> I use barebox to boot a linux kernel on an Intel atom based PC with an EFI bios and this just works. >> >> Now I wanted to configure the bios to enable the secure boot mode: this means I tried to write some >> EFI variables (db, dbx, KEK, PK); for this I used the efitools utils (efi-updatevar for example) but it didn't >> worked: I always get an 'Invalid argument' error. > In this case, neither barebox or the kernel are signed, right? yes, I can write the efi vars with the keys and certificates with the Bios gui and then enable the secure boot: then the bios will only load properly signed bootloader or kernel images. This already works. >> After some unsuccessful tries I booted the linux kernel directly from the bios, without barebox and in this >> case the efi-updatevar tool worked as expected; so I suppose that starting barebox has some kind of effect >> on the persistent store for the efi vars. > I am not familiar with UEFI secure boot, so I don't know if there is some lock > down happening here or what could cause this. Experimenting with the barebox configuration / source code (2024.8.0) I found that if I disable the PCI bus support in the barebox configuration (CONFIG_PCI) then my Invalid argument problem disappears. Then I tried to follow the pci bus initialization in the barebox source at: drivers/pci/pci.c and found that in the function pci_scan_bus(), in the for loop at devfn == 105 (0x69) there appear a device with IDs 8086:5a94: as soon as I include this device in the enumeration I have my Invalid argument problem, if I skip the device, with a hacky: if (devfn == 105) continue; at the beginning of the loop then the problem disappears. It seems something very special actually and I'm not really a guru about PCI initialization... I just hope someone with more experience on the matter can suggest a solution here; maybe the device should really be skipped (but not with my hacky if condition). If requested I could provide some more detail about the device... thanks again, giorgio
