From Newsgroup: muc.lists.freebsd.stable

Hi folks,

After 15.1-R branched, I performed major upgrade and took the idea of
setting up Secure Boot from my personal backlog. As a preparation
step, wanted to see which EFI variables I have, but that failed:
$ sudo efivar -l
efivar: error listing variables: Function not implemented

Tried to get variable that exists for sure but it also failed:
$ sudo efivar -n e11207ca-d4ad-11ee-928b-589cfc102103-Boot0000 -p
efivar: show variable: Function not implemented

Of course, module is loaded:
$ kldstat -v | grep efi
20 1 0xffffffff839a6000 46e9 efirt.ko (/boot/kernel/efirt.ko)
177 efidev
178 nexus/efirtc
176 efirt

And basically every command (except '-w' which I haven't verified
because I can't read variables, and '-L' which lists some GUIDs) fails
and efivar feels like a stub (at first glance it all was the same on
14). If I'm doing something wrong--I'd love to see some success
stories.

//CC: imp@ who's the only effective committer for the path of utility.
Please let me know if this is unwelcome.

--
wbr,
Anton


--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-admin@muc.de
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: muc.lists.freebsd.stable

On Sat, Jun 20, 2026 at 02:47:44PM +0300, Anton Saietskii wrote:

Hi folks,

After 15.1-R branched, I performed major upgrade and took the idea of
setting up Secure Boot from my personal backlog. As a preparation
step, wanted to see which EFI variables I have, but that failed:
$ sudo efivar -l
efivar: error listing variables: Function not implemented

Tried to get variable that exists for sure but it also failed:
$ sudo efivar -n e11207ca-d4ad-11ee-928b-589cfc102103-Boot0000 -p
efivar: show variable: Function not implemented

Of course, module is loaded:
$ kldstat -v | grep efi
20 1 0xffffffff839a6000 46e9 efirt.ko (/boot/kernel/efirt.ko)
177 efidev
178 nexus/efirtc
176 efirt

And basically every command (except '-w' which I haven't verified
because I can't read variables, and '-L' which lists some GUIDs) fails
and efivar feels like a stub (at first glance it all was the same on
14). If I'm doing something wrong--I'd love to see some success
stories.

Are there any kernel messages when you load the efirt.ko module?
Was the /dev/efi node created?


--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-admin@muc.de
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: muc.lists.freebsd.stable

On Sat, Jun 20, 2026 at 3:03rC>PM Konstantin Belousov <kostikbel@gmail.com> wrote:

On Sat, Jun 20, 2026 at 02:47:44PM +0300, Anton Saietskii wrote:

Hi folks,

After 15.1-R branched, I performed major upgrade and took the idea of setting up Secure Boot from my personal backlog. As a preparation
step, wanted to see which EFI variables I have, but that failed:
$ sudo efivar -l
efivar: error listing variables: Function not implemented

Tried to get variable that exists for sure but it also failed:
$ sudo efivar -n e11207ca-d4ad-11ee-928b-589cfc102103-Boot0000 -p
efivar: show variable: Function not implemented

Of course, module is loaded:
$ kldstat -v | grep efi
20 1 0xffffffff839a6000 46e9 efirt.ko (/boot/kernel/efirt.ko)
177 efidev
178 nexus/efirtc
176 efirt

And basically every command (except '-w' which I haven't verified
because I can't read variables, and '-L' which lists some GUIDs) fails
and efivar feels like a stub (at first glance it all was the same on
14). If I'm doing something wrong--I'd love to see some success
stories.

Are there any kernel messages when you load the efirt.ko module?

Nothing interesting I'd say, but this regular non-verbose boot:
$ grep efi /var/run/dmesg.boot
VT(efifb): resolution 1920x1080
[4] VT: Replacing driver "efifb" with new "drmfb".
[4] efirtc0: <EFI Realtime Clock>
[4] efirtc0: registered as a time-of-day clock, resolution 1.000000s

Was the /dev/efi node created?

Yes:
$ ll /dev/*efi*
crwx------ 1 root wheel 0x17b Jun 19 17:39 /dev/efi
$
Also, I believe it is working correctly as another tool, efibootmgr,
works perfectly fine (I took EFI variable with boot entry from there).
"Not implemented" errors from efivar look weird, but I'm not
proficient enough to determine if they are true, nor where they
actually come from (exe, lib, kernel, or firmware itself). What if the
list and read of variables are not actually implemented? (I don't
believe this is my system configuration though, the only relevant
thing would be WITHOUT_EFI source option but I wouldn't even get
efivar binaries with it enabled.)
--
wbr,
Anton
--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-admin@muc.de
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: muc.lists.freebsd.stable

On 2026-06-20 13:47, Anton Saietskii wrote:

Hi folks,

After 15.1-R branched, I performed major upgrade and took the idea of
setting up Secure Boot from my personal backlog. As a preparation
step, wanted to see which EFI variables I have, but that failed:
$ sudo efivar -l
efivar: error listing variables: Function not implemented

Tried to get variable that exists for sure but it also failed:
$ sudo efivar -n e11207ca-d4ad-11ee-928b-589cfc102103-Boot0000 -p
efivar: show variable: Function not implemented

Of course, module is loaded:
$ kldstat -v | grep efi
20 1 0xffffffff839a6000 46e9 efirt.ko (/boot/kernel/efirt.ko)
177 efidev
178 nexus/efirtc
176 efirt

And basically every command (except '-w' which I haven't verified
because I can't read variables, and '-L' which lists some GUIDs) fails
and efivar feels like a stub (at first glance it all was the same on
14). If I'm doing something wrong--I'd love to see some success
stories.

//CC: imp@ who's the only effective committer for the path of utility.
Please let me know if this is unwelcome.

--
wbr,
Anton

On a 14.4-system it seems to work, so that's something, I guess?

# freebsd-version -kru
14.4-RELEASE-p6
14.4-RELEASE-p6
14.4-RELEASE-p6
# efivar -l | wc -l
75
# efivar -n 8be4df61-93ca-11d2-aa0d-00e098032b8c-SecureBoot 8be4df61-93ca-11d2-aa0d-00e098032b8c-SecureBoot
0000: 00
# kldstat -v | grep -i efi
102 efidev
104 nexus/efirtc
322 pvefirt
103 efirt
# grep -i efi /var/log/dmesg.yesterday
VT(efifb): resolution 1024x768
efirtc0: <EFI Realtime Clock>
efirtc0: registered as a time-of-day clock, resolution 1.000000s

I tried to check on a 15.0 VM, but that one seems angry:
# efivar -l | wc -l
efivar: Error listing names: No such file or directory
0
# efibootmgr
efibootmgr: efi variables not supported on this system. kldload efirt?
# kldstat -v | grep -i efi
100 efidev
102 nexus/efirtc
322 pvefirt
101 efirt
# dmesg | grep -i efi
#

Probably not too much helpful information..


--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-admin@muc.de
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: muc.lists.freebsd.stable

--000000000000cbab9a0654b31afb
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Sat, Jun 20, 2026 at 11:33=E2=80=AFAM Daniel Lysfjord < lysfjord.daniel@smokepit.net> wrote:

On 2026-06-20 13:47, Anton Saietskii wrote:

Hi folks,

After 15.1-R branched, I performed major upgrade and took the idea of setting up Secure Boot from my personal backlog. As a preparation
step, wanted to see which EFI variables I have, but that failed:
$ sudo efivar -l
efivar: error listing variables: Function not implemented

Tried to get variable that exists for sure but it also failed:
$ sudo efivar -n e11207ca-d4ad-11ee-928b-589cfc102103-Boot0000 -p
efivar: show variable: Function not implemented

Of course, module is loaded:
$ kldstat -v | grep efi
20 1 0xffffffff839a6000 46e9 efirt.ko (/boot/kernel/efirt.ko)
177 efidev
178 nexus/efirtc
176 efirt

And basically every command (except '-w' which I haven't verified
because I can't read variables, and '-L' which lists some GUIDs) fails
and efivar feels like a stub (at first glance it all was the same on
14). If I'm doing something wrong--I'd love to see some success
stories.

//CC: imp@ who's the only effective committer for the path of utility. Please let me know if this is unwelcome.

--
wbr,
Anton

On a 14.4-system it seems to work, so that's something, I guess?

# freebsd-version -kru
14.4-RELEASE-p6
14.4-RELEASE-p6
14.4-RELEASE-p6
# efivar -l | wc -l
75
# efivar -n 8be4df61-93ca-11d2-aa0d-00e098032b8c-SecureBoot 8be4df61-93ca-11d2-aa0d-00e098032b8c-SecureBoot
0000: 00
# kldstat -v | grep -i efi
102 efidev
104 nexus/efirtc
322 pvefirt
103 efirt
# grep -i efi /var/log/dmesg.yesterday
VT(efifb): resolution 1024x768
efirtc0: <EFI Realtime Clock>
efirtc0: registered as a time-of-day clock, resolution 1.000000s

I tried to check on a 15.0 VM, but that one seems angry:
# efivar -l | wc -l
efivar: Error listing names: No such file or directory
0
# efibootmgr
efibootmgr: efi variables not supported on this system. kldload efirt?
# kldstat -v | grep -i efi
100 efidev
102 nexus/efirtc
322 pvefirt
101 efirt
# dmesg | grep -i efi
#

Probably not too much helpful information..

can you share truss efivar and truss efibootmgr please?

Warner

--000000000000cbab9a0654b31afb
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><br></div><br><div class=3D"gmail_quote g= mail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Sat, Jun 20,=
2026 at 11:33=E2=80=AFAM Daniel Lysfjord &lt;<a href=3D"mailto:lysfjord.da= niel@smokepit.net">lysfjord.daniel@smokepit.net</a>&gt; wrote:<br></div><bl= ockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-lef= t:1px solid rgb(204,204,204);padding-left:1ex">On 2026-06-20 13:47, Anton S= aietskii wrote:<br>
&gt; Hi folks,<br>
&gt; <br>
&gt; After 15.1-R branched, I performed major upgrade and took the idea of<=

&gt; setting up Secure Boot from my personal backlog. As a preparation<br>
&gt; step, wanted to see which EFI variables I have, but that failed:<br>
&gt; $ sudo efivar -l<br>
&gt; efivar: error listing variables: Function not implemented<br>
&gt; <br>
&gt; Tried to get variable that exists for sure but it also failed:<br>
&gt; $ sudo efivar -n e11207ca-d4ad-11ee-928b-589cfc102103-Boot0000 -p<br>
&gt; efivar: show variable: Function not implemented<br>
&gt; <br>
&gt; Of course, module is loaded:<br>
&gt; $ kldstat -v | grep efi<br>
&gt; 20=C2=A0 =C2=A0 1 0xffffffff839a6000=C2=A0 =C2=A0 =C2=A046e9 efirt.ko = (/boot/kernel/efirt.ko)<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0177 efide= v<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0178 nexus= /efirtc<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0176 efirt=

&gt; <br>
&gt; And basically every command (except &#39;-w&#39; which I haven&#39;t v= erified<br>
&gt; because I can&#39;t read variables, and &#39;-L&#39; which lists some = GUIDs) fails<br>
&gt; and efivar feels like a stub (at first glance it all was the same on<b=

&gt; 14). If I&#39;m doing something wrong--I&#39;d love to see some succes= s<br>
&gt; stories.<br>
&gt; <br>
&gt; //CC: imp@ who&#39;s the only effective committer for the path of util= ity.<br>
&gt; Please let me know if this is unwelcome.<br>
&gt; <br>
&gt; --<br>
&gt; wbr,<br>
&gt; Anton<br>

On a 14.4-system it seems to work, so that&#39;s something, I guess?<br>

# freebsd-version -kru<br>
14.4-RELEASE-p6<br>
14.4-RELEASE-p6<br>
14.4-RELEASE-p6<br>
# efivar -l | wc -l<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A075<br>
# efivar -n 8be4df61-93ca-11d2-aa0d-00e098032b8c-SecureBoot<br> 8be4df61-93ca-11d2-aa0d-00e098032b8c-SecureBoot<br>
0000: 00<br>
# kldstat -v | grep -i efi<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0102 efidev<br=

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0104 nexus/efi= rtc<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0322 pvefirt<b=

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0103 efirt<br>
# grep -i efi /var/log/dmesg.yesterday<br>
VT(efifb): resolution 1024x768<br>
efirtc0: &lt;EFI Realtime Clock&gt;<br>
efirtc0: registered as a time-of-day clock, resolution 1.000000s<br>

I tried to check on a 15.0 VM, but that one seems angry:<br>
# efivar -l | wc -l<br>
efivar: Error listing names: No such file or directory<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 0<br>
# efibootmgr<br>
efibootmgr: efi variables not supported on this system. kldload efirt?<br>
# kldstat -v | grep -i efi<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0100 efidev<br=

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0102 nexus/efi= rtc<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0322 pvefirt<b=

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0101 efirt<br>
# dmesg | grep -i efi<br>
#<br>

Probably not too much helpful information..<br></blockquote><div><br></div>= <div>can you share truss efivar and truss efibootmgr please?</div><div><br>= </div><div>Warner=C2=A0</div></div></div>

--000000000000cbab9a0654b31afb--


--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-admin@muc.de
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: muc.lists.freebsd.stable

On Sat, Jun 20, 2026 at 4:02rC>PM Konstantin Belousov <kostikbel@gmail.com> wrote:

"Not implemented" errors from efivar look weird, but I'm not
proficient enough to determine if they are true, nor where they
actually come from (exe, lib, kernel, or firmware itself). What if the
list and read of variables are not actually implemented? (I don't
believe this is my system configuration though, the only relevant
thing would be WITHOUT_EFI source option but I wouldn't even get
efivar binaries with it enabled.)

Look with ktrace to see which ioctl(2) fails.

Great suggestion! Discovered the following:
<CUT>
10848 efivar CALL statfs(0x3d4d61408000,0x2274d6d1ba70)
10848 efivar NAMI "/sys/firmware/efi/efivars/"
10848 efivar RET statfs -1 errno 2 No such file or directory
10848 efivar CALL open(0x2274d93c0f40,0x120000<O_RDONLY|O_DIRECTORY|O_CLOEXEC>)
10848 efivar NAMI "/sys/firmware/efi/vars/"
10848 efivar RET open -1 errno 2 No such file or directory
<CUT>
Which is not the path expected.
It worked in root session though. This raised a suspicion that maybe
some different efivar is being called, which was actually true.
sysutils/fwupd had devel/efivar in depends some time ago, but somehow
'pkg autoremove' didn't remove it.
efivar(8) from base system works completely fine. Thanks for pointing
me in the right direction.
--
wbr,
Anton
--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-admin@muc.de
--- Synchronet 3.22a-Linux NewsLink 1.2