Minimum sizes an OS can expect from the firmware

[lool]

Hi,

The OS might want to add/alter EFI variables and the firmware needs to reserve a reasonable amount of space for this. Typically, EFI variables might be used to store path names of boot assets or fingerprints. At worst, an OS might want to store a full key, but that's not a current scenario.

There might also need to be a minimum reserved space for a capsule update or to add certificates/keys to the PKI.

[lool]

Discussed at EBBR meeting on 2021-03-15; Heinrich provided following excepts from UEFI spec:
config EFI_VAR_BUF_SIZE
int "Memory size of the UEFI variable store"
default 16384
range 4096 2147483647
help
This defines the size in bytes of the memory area reserved for keeping
UEFI variables.

When using StandAloneMM (CONFIG_EFI_MM_COMM_TEE=y) this value should
match the value of PcdFlashNvStorageVariableSize used to compile the
StandAloneMM module.

Minimum 4096, default 16384.

[vstehle]

After call of Jan 16: this is configurable in U-Boot for example. Query variable info allows to retrieve the actual value at runtime. Adding a useful requirement in EBBR seems difficult. Can we close?

[lool]

So EBBR wont guarantee or recommend a minimum size? I guess if it can be queried, proper error handling can be implemented, fine with me.

[xypron]

https://uefi.org/sites/default/files/resources/UEFI_Plugfest_Security_Microsoft_Fall_2016.pdf has this statement:

"A total of at least 120 KB of non-volatile NVRAM storage memory must be available for NV UEFI variables (authenticated and unauthenticated, BS and RT) used by UEFI Secure Boot and Windows. The maximum supported variable size must be at least 64kB and there is no maximum NVRAM storage limit."

[xypron]

This is the current Windows requirement:

Windows Hardware Compatibility Specifications for Windows 11, version 22H2– Systems
(File systems.pdf in https://go.microsoft.com/fwlink/?linkid=2196181)

31. Reserved Memory for Windows Secure Boot UEFI Variables. A total of at least 128 KB of non-volatile NVRAM storage memory must be available for NV UEFI variables (authenticated and unauthenticated, BS and RT) used by UEFI Secure Boot and Windows, and the maximum supported variable size must be at least 64 KB. There is no maximum NVRAM storage limit. Note that this is an increase from Windows 10, version 1703 requirements of 64 KB total and 32 KB variable size."

[xypron]

[PATCH] efi_loader: Increase default variable store size to 32K indicates that with 16 KiB booting Debian via shim is not possible and suggests 32 KiB as default.

[xypron]

These are the sizes of dbx files downloaded form uefi.org:

• 4610 arm64_DBXUpdate.bin
• 8642 arm_DBXUpdate.bin
• 21170 x64_DBXUpdate.bin

Looking at these sizes the 16 KiB default with StandAloneMM in U-Boot seems inadequate.

[vstehle]

Reviving this issue a bit, now that we have more results from the "field" thanks to e.g. Linaro ONELab.

Typical "NVRAM" storage reported by FWTS is in [64K .. 128K].

[xypron]

We should follow Microsoft's recommendation of 128 KiB to allow the use of their security data base.

[xypron]

Maybe we should also give an ESP size recommendation. Windows 11 updates fail with 100 MB.

https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/configure-uefigpt-based-hard-drive-partitions?view=windows-11
has minimum sizes of 200 - 300 MB for the ESP.

When thinking of booting UKI kernels you probably want 512 MiB or more.

[ricardosalveti]

I think we should recommend >= 512mb for ESP, as you can easily have several UKIs available (multiple OSs, A/B, etc).