#1021245 linux-image-5.10.0-18-rt-amd64: can't access EFIVARS when using rt version of kernel

Package:
src:linux
Source:
src:linux
Submitter:
niek nooijens
Date:
2025-08-08 19:09:06 UTC
Severity:
normal
#1021245#5
Date:
2022-10-04 09:46:39 UTC
From:
To:
when Using the normal linux-image 5.10.0-18 I can use efibootmgr to change boot variables and /sys/firmware/efi/efivars is populated.
when using the real-time variant efibootmgr and efivar report "efi variables are not supported on this system" and /sys/firmware/efi/efivars is empty.
trying to insert the /lib/modules/kernel/fs/efivarfs/efivarfs.ko kernel module will result in a FAIL "no such file or directory" as well as modprobe.
I therefore conclude this is a bug, and problematic since I need to load signed kernel-modules for our industrial etherCAT stack and really need the whole EFI/secure-boot/mok chain to work on the rt_kernel.
#1021245#10
Date:
2022-10-04 12:46:14 UTC
From:
To:
This is no bug.  The EFI runtime services are explicitly disabled.  The
reason is:

| The EFI runtime services are disabled by default when PREEMPT_RT is enabled,
| because measurements have shown that some EFI functions calls might take too
| much time to complete, causing large latencies which is an issue for Real-Time
| kernels.

You can enable it by adding "efi=runtime" to the kernel command line.

Bastian
#1021245#15
Date:
2022-10-05 08:07:41 UTC
From:
To:
Hi Bastian

Thanks for the explanation. Feel free to close the ticket then, however I do have one question.
I did some test by creating my own kernel module and inserting it, which doesn't work (operation not permitted) indicating that the chain of trust is kept in-tact. (please confirm this is true)
However mokutil requires EFI variables, making configuration quite a pain in the ass, I know how to start with efi=runtime to allow it, but I want to make this process as seamless as possible for our customers who might need to load and sign ethercat modules. Do you have a suggestion on how to handle this?

thanks!

Niek


This is no bug.  The EFI runtime services are explicitly disabled.  The
reason is:

| The EFI runtime services are disabled by default when PREEMPT_RT is enabled,
| because measurements have shown that some EFI functions calls might take too
| much time to complete, causing large latencies which is an issue for Real-Time
| kernels.

You can enable it by adding "efi=runtime" to the kernel command line.

Bastian
#1021245#20
Date:
2022-10-07 08:05:07 UTC
From:
To:
[Removed OP]

I think we should enable that by default, given that we expect several
packages to write efi variables during the normal runtime.

And not been able to do such critical tasks is kind of suprising.

Bastian