efibootmgr?

[Tom Horsley]

I've been trying to decrypt efibootmgr docs and I've
given up :-).

I keep getting the impression you can't examine any
efi boot info other than the one currently active
which you booted from.

What if I want to stick a removable disk into the
system and examine the boot parameters on it?
Any way to point efi tools to a completely separate
non-root disk that just happens to be plugged into
the system?

[Samuel Sieb]

On 09/08/2018 06:01 AM, Tom Horsley wrote:
>  I keep getting the impression you can't examine any
>  efi boot info other than the one currently active
>  which you booted from.
>  
>  What if I want to stick a removable disk into the
>  system and examine the boot parameters on it?
>  Any way to point efi tools to a completely separate
>  non-root disk that just happens to be plugged into
>  the system? 
No, the boot parameters are in the NVRAM on the computer, not on the 
disk.  You can put the disk into another computer and the UEFI boot 
system might be able to boot from it, but only from the default boot 
file if the disk is setup correctly.

[Chris Murphy]

On Sat, Sep 8, 2018 at 7:01 AM, Tom Horsley <horsley1953(a)gmail.com&gt; wrote:
>  I've been trying to decrypt efibootmgr docs and I've
>  given up :-). 
The firmware situation is awful.


>  I keep getting the impression you can't examine any
>  efi boot info other than the one currently active
>  which you booted from. 
There is no firmware state information saved outside of NVRAM. The
gotcha is that efibootmgr doesn't show you everything. It only shows
boot entries and their order. If you look at
$ ls -l /sys/firmware/efi/efivars/

There's a lot of other crap in NVRAM.


>  What if I want to stick a removable disk into the
>  system and examine the boot parameters on it? 
sudo blkid
then mount any and all FAT12/16/32 volumes
then look inside EFI/BOOT

The firmware will default to booting any OS Loader found in EFI/BOOT

The only state information you'll find there is the OS Loader, not the firmware.

OS Loader = bootloader in UEFI parlance


>  Any way to point efi tools to a completely separate
>  non-root disk that just happens to be plugged into
>  the system? 
Nope. There's no firmware state information saved to disk.



-- 
Chris Murphy

[Tom Horsley]

On Sat, 8 Sep 2018 20:43:46 -0600
Chris Murphy wrote:

>  Nope. There's no firmware state information saved to disk.
There must be something on disk, because I keep
reading web pages that say things like:

You can create a new image file and add it to the
efi menu with efibootmgr (without, of course,
ever having an example :-).

Anyway, I think I've figured out my major problem
with the USB stick testing I've been doing: The
system I've been testing with apparently only claims
to support UEFI, both GPT partitions and UEFI
installs (even on a msdos partition) fail to work.

Only a traditional msdos partition and BIOS boot
actually works.

[Gordon Messmer]

On 09/09/2018 05:32 AM, Tom Horsley wrote:
>  On Sat, 8 Sep 2018 20:43:46 -0600
>  Chris Murphy wrote:
>
> > Nope. There's no firmware state information saved to disk.
>  There must be something on disk, because I keep reading web pages that say things like:
>
>  You can create a new image file 
The bootloader "file" is on the disk, but isn't firmware state information.

>  and add it to the efi menu with efibootmgr 
The EFI menu is firmware state information, but it's not on the disk.  
That's held in non-volatile RAM.

>  Anyway, I think I've figured out my major problem with the USB
> stick testing I've been doing: The system I've been testing with apparently only
> claims to support UEFI, both GPT partitions and UEFI installs (even on a msdos partition)
> fail to work.
>
>  Only a traditional msdos partition and BIOS boot actually works. 
Many UEFI systems support booting from either UEFI or "legacy" boot 
loaders.  Yours may have "legacy" prioritized so that it loads first, or 
it may be configured to only boot "legacy" mode for external devices.

[Chris Murphy]

On Sun, Sep 9, 2018 at 6:32 AM, Tom Horsley <horsley1953(a)gmail.com&gt; wrote:
>  On Sat, 8 Sep 2018 20:43:46 -0600
>  Chris Murphy wrote:
>
> > Nope. There's no firmware state information saved to disk.
>
>  There must be something on disk, because I keep
>  reading web pages that say things like:
>
>  You can create a new image file and add it to the
>  efi menu with efibootmgr (without, of course,
>  ever having an example :-). 
Example from an old anaconda/program.log

15:12:07,059 INFO program: Running... efibootmgr -c -w -L Fedora -d
/dev/md/Volume0_0 -p 1 -l \EFI\fedora\shim.efi

That gets translated by efibootmgr/efivars into an NVRAM boot entry.
But this is for making it persistent. It has nothing to do with
sticks. Sticks should have their bootloader in EFI/BOOT/BOOT<arch>.EFI
where <arch> is X64 on x86_64 systems, and IA32 for 32-bit UEFI
systems, and so on. The firmware has rules for the order it looks for
a valid OS Loader, that are in the UEFI spec. But the gist is that if
you plug in a stick you have to tell the firmware you want to boot off
the stick, and the way you do that is choosing that stick from a menu.
And then it knows to look in EFI/BOOT and then what arch EFI file it
should read and execute.


-- 
Chris Murphy

[Tom H]

On Sat, Sep 8, 2018 at 4:02 PM Tom Horsley <horsley1953(a)gmail.com&gt; wrote:


>  I've been trying to decrypt efibootmgr docs and I've given up
> :-).
>
>  I keep getting the impression you can't examine any efi boot info
>  other than the one currently active which you booted from. 
"efibootmgr" displays the boot entries held in nvram, whether those
entries refer to files that exist in the current boot or not. (The
files must exist in order to be added.)


>  What if I want to stick a removable disk into the system and examine
>  the boot parameters on it? Any way to point efi tools to a completely
>  separate non-root disk that just happens to be plugged into the system? 
There are no boot parameters on the stick. But there may be an nvram
boot entry pointing to an efi executable on the stick. But you don't
need the stick to be plugged-in for that entry to be displayed by
"efibootmgr".

You can add a boot entry pointing to a file on the stick. I don't have
a stick at hand, but to add the default "bootx64.efi" on my laptop:


%% display boot entries %%
# efibootmgr
BootCurrent: 0000
Timeout: 0 seconds
BootOrder: 0000,2001
Boot0000* funtoo
Boot2001* EFI USB Device


%% display boot entries with bootloader files %%
%% "d4e17079-..." is /dev/sda1's /dev/disk/by-partuuid/ entry %%
# efibootmgr -v
BootCurrent: 0000
Timeout: 0 seconds
BootOrder: 0000,2001
Boot0000* funtoo
HD(1,GPT,d4e17079-d8a8-412b-9cc6-24950f31b263,0x800,0x82000)/File(\EFI\funtoo\shimx64.efi)
Boot2001* EFI USB Device RC


%% create boot entry %%
# efibootmgr -c -d /dev/sda -p 1 -L fedusr -l '\EFI\Boot\bootx64.efi'
BootCurrent: 0000
Timeout: 0 seconds
BootOrder: 0001,0000,2001
Boot0000* funtoo
Boot2001* EFI USB Device
Boot0001* fedusr


%% display boot entries with bootloader files %%
# efibootmgr -v
BootCurrent: 0000
Timeout: 0 seconds
BootOrder: 0001,0000,2001
Boot0000* funtoo
HD(1,GPT,d4e17079-d8a8-412b-9cc6-24950f31b263,0x800,0x82000)/File(\EFI\funtoo\shimx64.efi)
Boot0001* fedusr
HD(1,GPT,d4e17079-d8a8-412b-9cc6-24950f31b263,0x800,0x82000)/File(\EFI\Boot\bootx64.efi)
Boot2001* EFI USB Device RC