eficonfig command

Synopsis

eficonfig

Description

The “eficonfig” command uses the U-Boot menu interface to provide a menu-driven UEFI variable maintenance feature. These are the top level menu entries:

Add Boot Option: Add a new UEFI Boot Option. The user can edit description, file path, and optional_data. The new boot opiton is appended to the boot order in the BootOrder variable. The user may want to update the boot order using the Change Boot Order menu entry.
Edit Boot Option: Edit an existing UEFI Boot Option. The User can edit description, file path, and optional_data.
Change Boot Order: Change the boot order updating the UEFI BootOrder variable.
Delete Boot Option: Delete a UEFI Boot Option
Secure Boot Configuration: Edit the UEFI Secure Boot Configuration

How to boot the system with a newly added UEFI Boot Option

The “eficonfig” command is used to set the UEFI boot options which are stored in the UEFI variable Boot#### where #### is a hexadecimal number.

The command bootefi bootmgr can be used to boot by trying in sequence all boot options selected by the variable BootOrder.

If the bootmenu is enabled, CONFIG_BOOTMENU_DISABLE_UBOOT_CONSOLE is enabled, and “eficonfig” is configured as preboot command, the newly added Boot Options are enumerated in the bootmenu when the user exits from the eficonfig menu. The user may select the entry in the bootmenu to boot the system, or follow the U-Boot configuration the system already has.

Auto boot with the UEFI Boot Option

To do auto boot according to the UEFI BootOrder variable, add “bootefi bootmgr” entry as a default or first bootmenu entry:

CONFIG_PREBOOT="setenv bootmenu_0 UEFI Boot Manager=bootefi bootmgr; setenv bootmenu_1 UEFI Maintenance Menu=eficonfig"

UEFI Secure Boot Configuration

The user can enroll the variables PK, KEK, db and dbx by selecting a file. The “eficonfig” command only accepts signed EFI Signature List(s) with an authenticated header, typically a “.auth” file.

To clear the PK, KEK, db and dbx, the user needs to enroll a null value signed by PK or KEK.

Configuration

The “eficonfig” command is enabled by:

CONFIG_CMD_EFICONFIG=y

If CONFIG_BOOTMENU_DISABLE_UBOOT_CONSOLE is enabled, the user can not enter U-Boot console. In this case, the bootmenu can be used to invoke “eficonfig”:

CONFIG_USE_PREBOOT=y
CONFIG_PREBOOT="setenv bootmenu_0 UEFI Maintenance Menu=eficonfig"

The only way U-Boot can currently store EFI variables on a tamper resistant medium is via OP-TEE. The Kconfig option that enables that is:

CONFIG_EFI_MM_COMM_TEE=y.

It enables storing EFI variables on the RPMB partition of an eMMC device.

The UEFI Secure Boot Configuration menu entry is only available if the following options are enabled:

CONFIG_EFI_SECURE_BOOT=y
CONFIG_EFI_MM_COMM_TEE=y