EFI stub

The (U)EFI firmware present in many newer computers can function as bootloader, allowing systems to boot without needing an additional software bootloader. This article shows how to configure and install an unsigned kernel in the EFI System Partition (ESP) of a computer running in EFI mode with secureboot turned off and how it shares the ESP with another OS for multiboot.

Partitioning
Create a partition of type "EFI System partition", which is  on GPT and   on MBR. Using :

Create a FAT32 filesystem inside:

If the command is not present (part of ), the Busybox version can be used instead:

Configuration
In order to boot directly from UEFI, the kernel needs to have these options enabled:

Enable GPT partition label support if that was used previously when partitioning the disk ( CONFIG_PARTITION_ADVANCED and CONFIG_EFI_PARTITION ):

Enable CONFIG_EFI and CONFIG_EFI_STUB support enabled. It is also a good idea to enable CONFIG_EFI_VARS so that the system firmware can be manipulated via. CONFIG_EFI_MIXED as proposed by Gentoo Handbook is not suitable for the EFI boot stub.

UEFI does not pass kernel parameters to the kernel during normal boot, so they must be hard-coded them via CONFIG_CMDLINE values. In order to boot a root partition located at input the following text in the kernel configuration:

Using  might be preferable. To find out use :

Optional: Initramfs
The EFI stub can load an initramfs and pass it to the kernel, but this requires passing a parameter from the EFI bootloader (ie. ). This parameter cannot be built into CONFIG_CMDLINE as outlined above. This may defeat the purpose of using EFI stub since many users prefer it as a way to avoid the necessity of a bootloader and/or dealing with. Another possibility is to embed the initramfs directly into the kernel image. In order to do this:


 * Generate the initramfs using a preferred method (Genkernel, Dracut, etc.).
 * Ensure the image is not compressed (just a cpio archive). Genkernel and Dracut both have command line switches for this.
 * Rename the initramfs with a extension, the kernel requires this in order to embed a cpio archive. The kernel image (with the cpio archive within it) will still be compressed as usual.
 * Ensure that the initramfs has the correct read-permissions for the user building the kernel. Most users build the kernel as the root user and may skip this step.
 * Be aware that Dracut makes the initramfs image readable only by the root user, so if the kernel was built as any other user adjust its permissions as needed. Failing to do so (and ignoring the kernel build warnings) will result in a kernel with no embedded initramfs which will leave the system potentially unbootable.

However, if passing an initramfs as a boot parameter is still desired, the only way it can be done is by using (GRUB2 will not work). An external initramfs has some advantages over building the initramfs directly into the kernel (see the kernel help on on the CONFIG_INITRAMFS_SOURCE variable for details on its limitations). In fact, both a built-in and external initramfs can be used simultaneously. Create and install the initramfs with Genkernel, Dracut, by hand, etc. Install the kernel as outlined in the Installation section below. Then:

Installation
Still in the kernel directory, build the kernel and install the modules:

Have the ESP mounted at :

(tree -L 3 /boot) /boot └── EFI └── Microsoft ├── Boot └── Recovery (Here the Microsoft subtree was created by an earlier installation of Windows 10 Creators Update)

Run the install command:

(tree -L 3 /boot) /boot ├── config-4.9.16-gentoo ├── EFI │   └── Microsoft │      ├── Boot │      └── Recovery ├── System.map-4.9.16-gentoo └── vmlinuz-4.9.16-gentoo

Move to the right place adding the  suffix and delete the copies of config and System.map:

(tree -L 3 /boot) /boot └── EFI ├── Gentoo │   └── vmlinuz-4.9.16-gentoo.efi └── Microsoft ├── Boot └── Recovery

Alternatively the fallback directory could be used additionally to or instead of.

Next, tell the UEFI firmware that a boot entry called "Gentoo" is to be created, which has the freshly compiled EFI stub kernel:

The latest added entry always gets highest boot priority, so it will be default. The available boot entries can be displayed triggering the EFI boot menu on early boot (on Dell laptops using ).

In case an (optional) initramfs is needed, it also needs to be copied to the same place.

Adding additional kernels
Optionally additional kernels can be made known to the UEFI firmware. This is especially useful when wanting to test more kernels or to dual-boot with another operating system. These will be shown in the boot selection prompt, normally after a keyboard hotkey is pressed at the right time during system initialization. If the hotkey combination is unknown, search for official documentation from the computer manufacture. This information is usually not difficult to find.

Ensure that CONFIG_EFI_VARS have been enabled in the kernel, install and make them known to the UEFI firmware.

External resources

 * EFI Stub - booting without a bootloader Blog posting which this article is partially based on.
 * GPT fdisk homepage with information and tutorials about GPT partitioning.
 * EFI bootloaders listing alternative ways to boot an (U)EFI system.
 * EFISTUB on wiki.archlinux.org