11

This might seem like a rather basic question, but I'm having a lot of trouble tracking down an answer...

How does EFI actually find stuff to boot?

Under the old BIOS scheme, if the MBR has a special marker than the contents are loaded into RAM and executed. What happens next depends on what that code does. In short, to make an OS bootable, you need to install the boot-loader of your choice into the MBR, and then do whatever else your chosen boot-loader expects in order to configure it. Usually the BIOS has some menu to let you configure which order it searches for a bootable MBR, but that's it.

Under EFI... I have literally no idea how this stuff works. As best as I can tell, it doesn't involve boot blocks at all, and only involves the EFI System Partition. But I can't find any details beyond that. Do the files in this partition have to be in a certain folder or named a particular way? Because my test laptop is totally ignoring anything I put there.

Secure Boot adds a second layer of fun to this. In order to work, a binary has to be signed. But I can't figure out whether the signature is inside the file itself, or whether there's supposed to be a seperate signature file next to it...

4
  • Just disable Secure Boot. You can always try it later. As for the rest: UEFI has an NVRAM where additional boot configuration is stored. Additional details are described in this answer.
    – Daniel B
    Mar 20, 2014 at 12:46
  • On my test laptop, Secure Boot cannot be disabled. You can turn off EFI, but you can't disable just the Secure Boot part. Apparently several motherboards have this particular bug... Mar 20, 2014 at 13:12
  • I find that hard to believe since the possibility to disable Secure Boot is a requirement for the Windows 8 Logo.
    – Daniel B
    Mar 20, 2014 at 13:46
  • You can "disable Secure Boot" by turning off EFI. Then you can boot anything. Just not with EFI. Mar 20, 2014 at 13:53

2 Answers 2

11

First the firmware looks for EFI variables Boot#### (e.g. Boot0000, Boot0001, and so on). They describe the EFI boot menu entries, and contain the complete location of the corresponding executable. For example:

$ sudo efibootmgr -v
BootCurrent: 0000
Timeout: 2 seconds
BootOrder: 0000,0001,0006,0007
Boot0000* Linux Boot Manager    HD(1,800,32000,785c8ca2-bb16-48fd-917b-19d69543338f)File(\EFI\gummiboot\gummibootx64.efi)
Boot0001* EFI Shell HD(1,800,32000,785c8ca2-bb16-48fd-917b-19d69543338f)File(\shellx64.efi)
Boot0006  Hard Drive    BIOS(2,0,00)P0: ST9640320AS               .
Boot0007  CD/DVD Drive  BIOS(3,0,00)P1: SlimtypeDVD A  DS8A5SH    .

This describes location of a SATA hard disk; a GPT partition UUID; and a path within that partition.

(Usually, all boot entries will point to the EFI system partition (type code EF for MBR, and C12A7328-F81F-11D2-BA4B-00A0C93EC93B for GPT – shown as EF00 in gdisk), but this is not required.)

If the firmware does not have any boot entries stored, or if you're booting from removable media, it uses the fallback location – it will look for all EFI system partitions (with the matching partition type and FAT32 filesystem), and within those partitions it will expect to find an EFI executable at \EFI\BOOT\BOOTX64.EFI. (This path is for Intel x86_64 systems; other architectures use different filenames in the same directory).

EFI will not automatically try to boot any random *.EFI file even if it's on the EFI system partition.

See also:

8
  • I am curious, has anybody actually gone through the intel/Microsoft/whatever paperwork? It seems to me at first glance that this documentation is kinda not so good. I mean, for instance, there seems no official procedure for using install media containing files larger than 4gb, which is... odd. I know this is Microsoft we're talking about but this seems excessive even for them. I would be happy to collaborate on a platform-independent "for dummies" writeup on UEFI and GPT as long as I don't end up doing the whole thing myself.
    – jamesson
    Mar 20, 2014 at 16:06
  • The install media is not required to have only one partition. It could have a tiny EFI system partition that boots the installer from an ext4 or NTFS one. Mar 20, 2014 at 16:07
  • Right, good. Now where is the "official" documentation on how to do that? Another example. GPT spec says that in addition to the main partition table there are 2 backups. Under what conditions are they updated, and how may they be restored?
    – jamesson
    Mar 20, 2014 at 16:08
  • There isn't any because this procedure is OS- and bootloader-dependent... gummiboot.efi and Windows bootmgfw.efi have their own methods. Mar 20, 2014 at 16:09
  • ok, so for windows I would need to look at documentation on bootmgw.efi?
    – jamesson
    Mar 20, 2014 at 16:09
1

As best as I can tell, it appears that you're supposed to boot EFI by creating an ESP (an MBR partition with type-code 0xEF, formatted as some variant of FAT) and copy a *.efi file into it.

In my testing, any and all such files are completely ignored, unless the name of the file is exactly

/EFI/BOOT/bootx64.efi

So it appears that this is the magic name you have to use.

At this point, I have no idea whether this is part of the official EFI specification, or merely a quirk of my particular motherboard. I am posting this information here in case it helps somebody else...

Using this knowledge, I was able to copy the rEFInd files onto a USB disk, rename the main executable, and observe the laptop whine that the binary isn't signed. (Which it isn't.) So now it sees that there's something potentially bootable there. It appears that if I could turn off Secure Boot, the laptop would boot at this point.

(Sadly I can't currently get Shim to work - but that's a different question...)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .