Hi Bastian
Thanks for the explanation. Feel free to close the ticket then, however I do
have one question.
I did some test by creating my own kernel module and inserting it, which
doesn't work (operation not permitted) indicating that the chain of trust is
kept in-tact. (please confirm this is true)
However mokutil requires EFI variables, making configuration quite a pain in
the ass, I know how to start with efi=runtime to allow it, but I want to make
this process as seamless as possible for our customers who might need to load
and sign ethercat modules. Do you have a suggestion on how to handle this?
thanks!
Niek
________________________________
From: Bastian Blank <wa...@debian.org>
Sent: Tuesday, October 4, 2022 2:46 PM
To: Niek Nooijens / IAB <niek.nooij...@omron.com>; 1021...@bugs.debian.org
<1021...@bugs.debian.org>
Subject: Re: Bug#1021245: linux-image-5.10.0-18-rt-amd64: can't access EFIVARS
when using rt version of kernel
On Tue, Oct 04, 2022 at 11:46:39AM +0200, niek nooijens wrote:
> when Using the normal linux-image 5.10.0-18 I can use efibootmgr to change
> boot variables and /sys/firmware/efi/efivars is populated.
> when using the real-time variant efibootmgr and efivar report "efi variables
> are not supported on this system" and /sys/firmware/efi/efivars is empty.
> trying to insert the /lib/modules/kernel/fs/efivarfs/efivarfs.ko kernel
> module will result in a FAIL "no such file or directory" as well as modprobe.
> I therefore conclude this is a bug, and problematic since I need to load
> signed kernel-modules for our industrial etherCAT stack and really need the
> whole EFI/secure-boot/mok chain to work on the rt_kernel.
This is no bug. The EFI runtime services are explicitly disabled. The
reason is:
| The EFI runtime services are disabled by default when PREEMPT_RT is enabled,
| because measurements have shown that some EFI functions calls might take too
| much time to complete, causing large latencies which is an issue for Real-Time
| kernels.
You can enable it by adding "efi=runtime" to the kernel command line.
Bastian
--
I have never understood the female capacity to avoid a direct answer to
any question.
-- Spock, "This Side of Paradise", stardate 3417.3
