| .. SPDX-License-Identifier: GPL-2.0+ | |
| .. (C) Copyright 2022, Masahisa Kojima <masahisa.kojima@linaro.org> | |
| eficonfig command | |
| ================= | |
| Synopsis | |
| -------- | |
| :: | |
| eficonfig | |
| Description | |
| ----------- | |
| The "eficonfig" command uses the U-Boot menu interface to provide a | |
| menu-driven UEFI variable maintenance feature. These are the top level menu | |
| entries: | |
| Add Boot Option | |
| Add a new UEFI Boot Option. | |
| The user can edit description, file path, and optional_data. | |
| The new boot opiton is appended to the boot order in the *BootOrder* | |
| variable. The user may want to update the boot order using the | |
| *Change Boot Order* menu entry. | |
| Edit Boot Option | |
| Edit an existing UEFI Boot Option. | |
| The User can edit description, file path, and optional_data. | |
| Change Boot Order | |
| Change the boot order updating the UEFI BootOrder variable. | |
| Delete Boot Option | |
| Delete a UEFI Boot Option | |
| Secure Boot Configuration | |
| Edit the UEFI Secure Boot Configuration | |
| How to boot the system with a newly added UEFI Boot Option | |
| '''''''''''''''''''''''''''''''''''''''''''''''''''''''''' | |
| The "eficonfig" command is used to set the UEFI boot options which are stored | |
| in the UEFI variable Boot#### where #### is a hexadecimal number. | |
| The command *bootefi bootmgr* can be used to boot by trying in sequence all | |
| boot options selected by the variable *BootOrder*. | |
| If the bootmenu is enabled, CONFIG_BOOTMENU_DISABLE_UBOOT_CONSOLE is enabled, | |
| and "eficonfig" is configured as preboot command, the newly added Boot Options | |
| are enumerated in the bootmenu when the user exits from the eficonfig menu. | |
| The user may select the entry in the bootmenu to boot the system, or follow | |
| the U-Boot configuration the system already has. | |
| Auto boot with the UEFI Boot Option | |
| ''''''''''''''''''''''''''''''''''' | |
| To do auto boot according to the UEFI BootOrder variable, | |
| add "bootefi bootmgr" entry as a default or first bootmenu entry:: | |
| CONFIG_PREBOOT="setenv bootmenu_0 UEFI Boot Manager=bootefi bootmgr; setenv bootmenu_1 UEFI Maintenance Menu=eficonfig" | |
| UEFI Secure Boot Configuration | |
| '''''''''''''''''''''''''''''' | |
| The user can enroll the variables PK, KEK, db and dbx by selecting a file. | |
| The "eficonfig" command only accepts signed EFI Signature List(s) with an | |
| authenticated header, typically a ".auth" file. | |
| To clear the PK, KEK, db and dbx, the user needs to enroll a null value | |
| signed by PK or KEK. | |
| Configuration | |
| ------------- | |
| The "eficonfig" command is enabled by:: | |
| CONFIG_CMD_EFICONFIG=y | |
| If CONFIG_BOOTMENU_DISABLE_UBOOT_CONSOLE is enabled, the user can not enter | |
| U-Boot console. In this case, the bootmenu can be used to invoke "eficonfig":: | |
| CONFIG_USE_PREBOOT=y | |
| CONFIG_PREBOOT="setenv bootmenu_0 UEFI Maintenance Menu=eficonfig" | |
| The only way U-Boot can currently store EFI variables on a tamper | |
| resistant medium is via OP-TEE. The Kconfig option that enables that is:: | |
| CONFIG_EFI_MM_COMM_TEE=y. | |
| It enables storing EFI variables on the RPMB partition of an eMMC device. | |
| The UEFI Secure Boot Configuration menu entry is only available if the following | |
| options are enabled:: | |
| CONFIG_EFI_SECURE_BOOT=y | |
| CONFIG_EFI_MM_COMM_TEE=y | |
| See also | |
| -------- | |
| * :doc:`bootmenu<bootmenu>` provides a simple mechanism for creating menus with | |
| different boot items |