| Masahisa Kojima | dfcf0e5 | 2022-09-12 17:33:58 +0900 | [diff] [blame] | 1 | .. SPDX-License-Identifier: GPL-2.0+ |
| 2 | .. (C) Copyright 2022, Masahisa Kojima <masahisa.kojima@linaro.org> |
| 3 | |
| 4 | eficonfig command |
| 5 | ================= |
| 6 | |
| 7 | Synopsis |
| 8 | -------- |
| 9 | :: |
| 10 | |
| 11 | eficonfig |
| 12 | |
| 13 | Description |
| 14 | ----------- |
| 15 | |
| Masahisa Kojima | 0746842 | 2022-12-02 13:59:37 +0900 | [diff] [blame] | 16 | The "eficonfig" command uses the U-Boot menu interface to provide a |
| 17 | menu-driven UEFI variable maintenance feature. These are the top level menu |
| 18 | entries: |
| Masahisa Kojima | dfcf0e5 | 2022-09-12 17:33:58 +0900 | [diff] [blame] | 19 | |
| 20 | Add Boot Option |
| Masahisa Kojima | 0746842 | 2022-12-02 13:59:37 +0900 | [diff] [blame] | 21 | Add a new UEFI Boot Option. |
| 22 | The user can edit description, file path, and optional_data. |
| 23 | The new boot opiton is appended to the boot order in the *BootOrder* |
| 24 | variable. The user may want to update the boot order using the |
| 25 | *Change Boot Order* menu entry. |
| Masahisa Kojima | dfcf0e5 | 2022-09-12 17:33:58 +0900 | [diff] [blame] | 26 | |
| 27 | Edit Boot Option |
| Masahisa Kojima | 0746842 | 2022-12-02 13:59:37 +0900 | [diff] [blame] | 28 | Edit an existing UEFI Boot Option. |
| 29 | The User can edit description, file path, and optional_data. |
| Masahisa Kojima | dfcf0e5 | 2022-09-12 17:33:58 +0900 | [diff] [blame] | 30 | |
| 31 | Change Boot Order |
| Masahisa Kojima | 0746842 | 2022-12-02 13:59:37 +0900 | [diff] [blame] | 32 | Change the boot order updating the UEFI BootOrder variable. |
| Masahisa Kojima | dfcf0e5 | 2022-09-12 17:33:58 +0900 | [diff] [blame] | 33 | |
| 34 | Delete Boot Option |
| Masahisa Kojima | 0746842 | 2022-12-02 13:59:37 +0900 | [diff] [blame] | 35 | Delete a UEFI Boot Option |
| Masahisa Kojima | dfcf0e5 | 2022-09-12 17:33:58 +0900 | [diff] [blame] | 36 | |
| Masahisa Kojima | 0746842 | 2022-12-02 13:59:37 +0900 | [diff] [blame] | 37 | Secure Boot Configuration |
| 38 | Edit the UEFI Secure Boot Configuration |
| Masahisa Kojima | dfcf0e5 | 2022-09-12 17:33:58 +0900 | [diff] [blame] | 39 | |
| Masahisa Kojima | 0746842 | 2022-12-02 13:59:37 +0900 | [diff] [blame] | 40 | How to boot the system with a newly added UEFI Boot Option |
| 41 | '''''''''''''''''''''''''''''''''''''''''''''''''''''''''' |
| Masahisa Kojima | dfcf0e5 | 2022-09-12 17:33:58 +0900 | [diff] [blame] | 42 | |
| Masahisa Kojima | 0746842 | 2022-12-02 13:59:37 +0900 | [diff] [blame] | 43 | The "eficonfig" command is used to set the UEFI boot options which are stored |
| 44 | in the UEFI variable Boot#### where #### is a hexadecimal number. |
| Masahisa Kojima | dfcf0e5 | 2022-09-12 17:33:58 +0900 | [diff] [blame] | 45 | |
| Masahisa Kojima | 0746842 | 2022-12-02 13:59:37 +0900 | [diff] [blame] | 46 | The command *bootefi bootmgr* can be used to boot by trying in sequence all |
| 47 | boot options selected by the variable *BootOrder*. |
| Masahisa Kojima | dfcf0e5 | 2022-09-12 17:33:58 +0900 | [diff] [blame] | 48 | |
| Masahisa Kojima | dfcf0e5 | 2022-09-12 17:33:58 +0900 | [diff] [blame] | 49 | If the bootmenu is enabled, CONFIG_BOOTMENU_DISABLE_UBOOT_CONSOLE is enabled, |
| 50 | and "eficonfig" is configured as preboot command, the newly added Boot Options |
| Masahisa Kojima | 0746842 | 2022-12-02 13:59:37 +0900 | [diff] [blame] | 51 | are enumerated in the bootmenu when the user exits from the eficonfig menu. |
| 52 | The user may select the entry in the bootmenu to boot the system, or follow |
| Masahisa Kojima | dfcf0e5 | 2022-09-12 17:33:58 +0900 | [diff] [blame] | 53 | the U-Boot configuration the system already has. |
| 54 | |
| 55 | Auto boot with the UEFI Boot Option |
| 56 | ''''''''''''''''''''''''''''''''''' |
| 57 | |
| 58 | To do auto boot according to the UEFI BootOrder variable, |
| 59 | add "bootefi bootmgr" entry as a default or first bootmenu entry:: |
| 60 | |
| 61 | CONFIG_PREBOOT="setenv bootmenu_0 UEFI Boot Manager=bootefi bootmgr; setenv bootmenu_1 UEFI Maintenance Menu=eficonfig" |
| 62 | |
| Masahisa Kojima | 0746842 | 2022-12-02 13:59:37 +0900 | [diff] [blame] | 63 | UEFI Secure Boot Configuration |
| 64 | '''''''''''''''''''''''''''''' |
| 65 | |
| 66 | The user can enroll the variables PK, KEK, db and dbx by selecting a file. |
| 67 | The "eficonfig" command only accepts signed EFI Signature List(s) with an |
| 68 | authenticated header, typically a ".auth" file. |
| 69 | |
| 70 | To clear the PK, KEK, db and dbx, the user needs to enroll a null value |
| 71 | signed by PK or KEK. |
| 72 | |
| 73 | Configuration |
| 74 | ------------- |
| 75 | |
| 76 | The "eficonfig" command is enabled by:: |
| 77 | |
| 78 | CONFIG_CMD_EFICONFIG=y |
| 79 | |
| 80 | If CONFIG_BOOTMENU_DISABLE_UBOOT_CONSOLE is enabled, the user can not enter |
| 81 | U-Boot console. In this case, the bootmenu can be used to invoke "eficonfig":: |
| 82 | |
| 83 | CONFIG_USE_PREBOOT=y |
| 84 | CONFIG_PREBOOT="setenv bootmenu_0 UEFI Maintenance Menu=eficonfig" |
| 85 | |
| 86 | The only way U-Boot can currently store EFI variables on a tamper |
| 87 | resistant medium is via OP-TEE. The Kconfig option that enables that is:: |
| 88 | |
| 89 | CONFIG_EFI_MM_COMM_TEE=y. |
| 90 | |
| 91 | It enables storing EFI variables on the RPMB partition of an eMMC device. |
| 92 | |
| 93 | The UEFI Secure Boot Configuration menu entry is only available if the following |
| 94 | options are enabled:: |
| 95 | |
| 96 | CONFIG_EFI_SECURE_BOOT=y |
| 97 | CONFIG_EFI_MM_COMM_TEE=y |
| 98 | |
| Masahisa Kojima | dfcf0e5 | 2022-09-12 17:33:58 +0900 | [diff] [blame] | 99 | See also |
| 100 | -------- |
| Masahisa Kojima | 0746842 | 2022-12-02 13:59:37 +0900 | [diff] [blame] | 101 | |
| 102 | * :doc:`bootmenu<bootmenu>` provides a simple mechanism for creating menus with |
| 103 | different boot items |