EFI stub kernel
The (U)EFI firmware present in many computers can function as bootloader, allowing systems to boot without needing an additional software bootloader. This article shows how to configure and install an unsigned kernel in the EFI System Partition (ESP) of a computer running in EFI mode with secureboot turned off.
In order to boot directly from UEFI, the kernel needs to know where to find the root (/) partition of the system to be booted. Enable EFI runtime service support (CONFIG_EFI), EFI stub support (CONFIG_EFI_STUB) and Built-in kernel command line (CONFIG_CMDLINE_BOOL) and add the root partition path (example: /dev/sda2) or its PARTUUID to (CONFIG_CMDLINE).
Processor type and features ---> [*] EFI runtime service support [*] EFI stub support [ ] EFI mixed-mode support ... ... [*] Built-in kernel command line (root=/dev/sda2)
root=PARTUUID= might be preferable. To find out use blkid:
The partition's PARTUUID is distinct from the filesystem's UUID.
blkid | grep sda2
/dev/sda2: UUID="d1e0c1e0-3a40-42c5-8931-cfa2c7deae32" TYPE="ext4" PARTUUID="adf55784-15d9-4ca3-bb3f-56de0b35d88d"
Processor type and features ---> [*] Built-in kernel command line (root=PARTUUID=adf55784-15d9-4ca3-bb3f-56de0b35d88d)
It is also a good idea to enable EFI Variable Support via sysfs (CONFIG_EFI_VARS) so that the efivars can be mounted. CONFIG_EFI_MIXED as proposed by Gentoo Handbook is not needed for the EFI boot stub.
Firmware Drivers ---> EFI (Extensible Firmware Interface) Support ---> <*> EFI Variable Support via sysfs
If an ESP does not exist, one needs to be created. See EFI System Partition. Still in the kernel directory, build the kernel and install the modules:
Have the ESP mounted at /boot:
mount /dev/sda1 /boot
Run the install command:
sh ./arch/x86/boot/install.sh 4.9.16-gentoo arch/x86/boot/bzImage \ System.map "/boot"
tree -L 2 /boot
/boot ├── config-4.9.16-gentoo ├── EFI ├── System.map-4.9.16-gentoo └── vmlinuz-4.9.16-gentoo
Move vmlinuz to the right place adding the .efi suffix and delete the copies of config and System.map:
mkdir -p /boot/EFI/Gentoo
mv /boot/vmlinuz-4.9.16-gentoo /boot/EFI/Gentoo/vmlinuz-4.9.16-gentoo.efi
rm /boot/config-4.9.16-gentoo /boot/System.map-4.9.16-gentoo
tree -L 3 /boot
/boot └── EFI └── Gentoo └── vmlinuz-4.9.16-gentoo.efi
Alternatively the fallback directory /boot/EFI/Boot could be used additionally to or instead of /boot/EFI/Gentoo.
Next, run efibootmgr to tell the UEFI firmware that a boot entry called "Gentoo" is to be created, referring to the freshly compiled EFI stub kernel:
efibootmgr --create --disk /dev/sda --part 1 --label "Gentoo" --loader '\efi\gentoo\vmlinuz-4.9.16-gentoo.efi'
EFI uses \ (backslash) as path separators.
In case an (optional) initramfs is needed, it also needs to be copied to the same place.
mv /boot/initramfs-4.9.16-gentoo.img /boot/EFI/Gentoo/initramfs.img
efibootmgr --create --part 1 --label "Gentoo" --loader '\efi\gentoo\vmlinuz-4.9.16-gentoo.efi' -u 'initrd=\efi\gentoo\initramfs.img'
It should be noted that EFI stub kernels can not load an initramfs if it is specified in CONFIG_CMDLINE. Check out efibootmgr, CONFIG_INITRAMFS_SOURCE, or separate bootloaders like gummiboot or refind if an initramfs is a must-have.
The EFI stub can load an initramfs and pass it to the kernel, but this requires passing a parameter from the EFI bootloader (ie.
initrd=\efi\boot\myinitrd.img). Another possibility is to embed the initramfs directly into the kernel image. In order to do this:
- Generate the initramfs using a preferred method (Genkernel, Dracut, etc.).
- Ensure the image is not compressed (just a cpio archive). Genkernel and Dracut both have command line switches for this.
- Rename the initramfs with a .cpio extension, the kernel requires this in order to embed a cpio archive. The kernel image (with the cpio archive within it) will still be compressed as usual.
- Ensure that the initramfs has the correct read-permissions for the user building the kernel. Most users build the kernel as the root user and may skip this step.
- Be aware that Dracut makes the initramfs image readable only by the root user, so if the kernel was built as any other user adjust its permissions as needed. Failing to do so (and ignoring the kernel build warnings) will result in a kernel with no embedded initramfs which will leave the system potentially unbootable.
General setup ---> [*] Initial RAM filesystem and RAM disk (initramfs/initrd) support (/boot/initramfs-3.12.21-gentoo-r1.cpio) Initramfs source file(s)
However, if passing an initramfs as a boot parameter is still desired, the only way it can be done is by using efibootmgr (GRUB2 will not work). An external initramfs has some advantages over building the initramfs directly into the kernel (see the kernel help on on the CONFIG_INITRAMFS_SOURCE variable for details on its limitations). In fact, both a built-in and external initramfs can be used simultaneously. Create and install the initramfs with Genkernel, Dracut, by hand, etc. Install the kernel as outlined in the Installation section below. Then:
This guide was created with the x64 architecture in mind. According the specification, UEFI is rich enough to cover a range of contemporary processor designs.
UEFI image's name is composed by the machine type defined in the PE32+ format  . For example, a UEFI OS loader for the x86 architecture is bootIA32.efi
- efibootmgr — a tool for managing UEFI boot entries
- efibootmgr in Handbook:AMD64/Installation/Bootloader#Alternative 2: efibootmgr
- Architecture specific kernel configuration (AMD64 Handbook) - should widely equal the #Kernel configuration section above
- rEFInd — a boot manager for EFI and UEFI platforms and not needed for EFI stub kernels
- EFI Stub - booting without a bootloader Blog posting which this article is partially based on.
- EFI bootloaders listing alternative ways to boot an (U)EFI system.
- EFISTUB on wiki.archlinux.org
- UEFI Specification Version 2.6, Section 2.1.1 UEFI Images, p.18, January 2016. UEFI Forum. Retrieved on October 10, 2016.
- UEFI Specification Version 2.6, Section 22.214.171.124 Removable Media Boot Behavior, p.90, January 2016. UEFI Forum. Retrieved on October 10, 2016.