Description
In the current implementation, we can add UEFI variables using the Add
key under NVRAM
. The way OcSetNvramVariable
works is that it attempts to read the variable. If it's not found, then it will add it with the flags EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS
. Block
can be used to delete the variable first in order to always force the Add
value instead.
I propose a third option. Either a new key Persist
that operates like Add
but creates the variable with EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS
. Or a new option PersistAdd
with a boolean value that will mask EFI_VARIABLE_NON_VOLATILE
for Add
variables.
Why is this useful? Consider the following use case: We need some base set of boot-args
to boot up OSX. So we add them with Add
. However, in the process of development/testing unrelated stuff, we wish to modify boot-args
by appending some new string. Using sudo nvram boot-args="new value"
fails because OSX will try to use the attribute EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS
and it fails because in the EFI specs:
If a preexisting variable is rewritten with different attributes,
SetVariable()
shall not modify the variable and shall returnEFI_INVALID_PARAMETER
.
Okay, so what if we just don't put boot-args
into the config.plist. Instead we just set sudo nvram boot-args="some value"
initially. That works, except if we require certain boot-args
to boot, then forgetting to append them will make the system unbootable (even more painful if the vault is used). So ideally, we can use OC's "erase nvram" option to wipe all the variables and then reset them with a clean default.
A second use case: csr-active-config
is used for SIP. OSX does the checks to make sure csr-active-config
is only modified in recovery OS. However, setting it in recovery OS still doesn't work if there is already an Add
entry. But if we do not include csr-active-config
in both Add
then using OC's "erase nvram" option will always enable SIP.
An option to allow the NVRAM options in config.plist to act as a signed/verified golden default configuration but still allow modification to NVRAM through normal OSX techniques would be useful.