AW: Re: barebox on EFI bios and secure boot

[giorgio.nicole at arcor.de]

Hallo Ahmad,


thank you for the answer,


>> I use barebox to boot a linux kernel on an Intel atom based PC with an EFI bios and this just works.
>> 
>> Now I wanted to configure the bios to enable the secure boot mode: this means I tried to write some
>> EFI variables (db, dbx, KEK, PK); for this I used the efitools utils (efi-updatevar for example) but it didn't
>> worked: I always get an 'Invalid argument' error.

> In this case, neither barebox or the kernel are signed, right?

yes, I can write the efi vars with the keys and certificates with the Bios gui and then enable the secure boot: then
the bios will only load properly signed bootloader or kernel images.
This already works.

>> After some unsuccessful tries I booted the linux kernel directly from the bios, without barebox and in this
>> case the efi-updatevar tool worked as expected; so I suppose that starting barebox has some kind of effect
>> on the persistent store for the efi vars.

> I am not familiar with UEFI secure boot, so I don't know if there is some lock
> down happening here or what could cause this.

Experimenting with the barebox configuration / source code (2024.8.0) I found that if I disable the PCI bus support
in the barebox configuration (CONFIG_PCI) then my Invalid argument problem disappears.

Then I tried to follow the pci bus initialization in the barebox source at: drivers/pci/pci.c and found that in the function
pci_scan_bus(), in the for loop at devfn == 105 (0x69) there appear a device with IDs 8086:5a94: as soon as I include
this device in the enumeration I have my Invalid argument problem, if I skip the device, with a hacky:

if (devfn == 105) continue;

at the beginning of the loop then the problem disappears.

It seems something very special actually and I'm not really a guru about PCI initialization...

I just hope someone with more experience on the matter can suggest a solution here; maybe the device should
really be skipped (but not with my hacky if condition).

If requested I could provide some more detail about the device...

thanks again,
giorgio