68daa04654
Embedded boards have hardware limitations when storing and managing EFI
variables. Some hardware comes with an eMMC & an RPMB partition which they
use to store the EFI variables securely. However, the vast majority of
boards (using U-Boot), stores the EFI variables in a file in the ESP.
This has a few limitations
- UEFI secure boot cannot be enabled as it can be very easily
overridden
- SetVariable at runtime is impossible to support
Distros and capsule updates on-disk do rely on the that service though
and U-Boot does implement a workaround.
U-Boot enables SetVariableRT in the RTPROP table and creates a memory backend,
so the linux kernel can naturally read and write variables via the efivarfs
filesystem. Those reads and writes end up in memory though. So they are visible
while the OS is live and are lost in the event of a reboot.
At the same time it also creates two EFI RO variables.
RTStorageVolatile -- Holds the filename the variables are stored relative to
the ESP
VarToFile -- Holds a binary dump of all the EFI variables that should be
preserved (BS, NV, RT).
By using these two variables we can persist the changes after reboots by
doing
dd if=/sys/firmware/efi/efivars/VarToFile-b2ac5fc9-92b7-4acd-aeac-11e818c3130c of=/boot/efi/ubootefi.var skip=4 bs=1
So let's plug this functionality into the efivafs backend and enable it
automatically if those variables are detected.
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
|
||
|---|---|---|
| .github/workflows | ||
| docs | ||
| src | ||
| tests | ||
| .gitignore | ||
| CODE_OF_CONDUCT.md | ||
| COPYING | ||
| efivar.spec.in | ||
| Makefile | ||
| README.md | ||
| TODO | ||
efivar
Tools and libraries to manipulate EFI variables
This library is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation; either version 2.1 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License along with this library. If not, see http://www.gnu.org/licenses/.
There is an ABI tracker for this project at ABI Laboratory.
WARNING
You should probably not run "make a brick" ever, unless you're already reasonably sure it won't permanently corrupt your firmware. This is not a joke.