UEFI: Difference between revisions

From Alpine Linux
(This page is so bad, this will take hours to rewrite... This is my start)
(moved Tip from introduction section)
 
(53 intermediate revisions by 10 users not shown)
Line 1: Line 1:
= UEFI and BIOS definitions and introduction =
{{TOC right}}
[https://en.wikipedia.org/wiki/UEFI Unified Extensible Firmware Interface(UEFI)] is a specification for the firmware architecture of a computing platform. This page documents how Alpine Linux works with devices using UEFI firmware.


In the old days, BIOS (for '''B'''asic '''I'''nput '''O'''utput '''S'''ystem) was how computers booted from the 1980s onwards. But now in newer hardware for laptops and desktops computers the UEFI (for '''U'''nified '''E'''xtensible '''F'''irmware '''I'''nterface) defines a software interface between an operating system and platform firmware into the vendor hardware.
== EFI system partition ==


UEFI replaces the BIOS firmware interface originally present in all IBM PC-compatible personal computers, early modern computer's UEFI firmware implementations provide legacy support for BIOS services.
UEFI requires a partition called "EFI System Partition" (ESP) - a FAT32 partition where the OS [[Bootloaders|bootloader]] apps get installed to. This is also commonly known as ESP partition.


== The history so far ==
The UEFI specification defines a standard boot path for systems without NVRAM entries as follows:
  <EFI_SYSTEM_PARTITION>\EFI\BOOT\BOOT<MACHINE_TYPE_SHORT_NAME>.EFI


Due newer incoming 64-bit incoming processors the older computers boot process are not more possible. It started life on Itanium (Intel's first 64-bit processor) systems. Itanium had no support for 32-bit, and certainly no embedded 80286, so they had to come up with a different system.  
Most of the programs that are expected to run in the UEFI environment are bootloaders, but other utilities might exist too. There are also programs to deal with firmware updates from motherboard manufacturers which can run before operating system startup like <Code>fwupdate/fwupd</Code>.


Intel developed the original Extensible Firmware Interface (EFI) specification. Some of the EFI's practices and data formats mirror those from Microsoft Windows.[4][5] In 2005, UEFI deprecated EFI 1.10 (the final release of EFI). The Unified EFI Forum is the industry body that manages the UEFI specification.
=== EFI bootloaders ===


= Alpine UEFI support =
When installing Alpine linux in [[System Disk Mode]], the [https://gitlab.alpinelinux.org/alpine/alpine-conf/-/blob/db542902/setup-disk.in#L319-L334 setup-disk script] creates both a named bootloader (in \EFI\alpine\) and a copy at the
standard boot path (in \EFI\boot\) for all architectures as shown in the below table. The installation script does not create NVRAM boot entries.


The '''support for
{| class="wikitable"
[https://en.wikipedia.org/wiki/EFI_system_partition EFI System Partition] was started in the [https://alpinelinux.org/posts/Alpine-3.7.0-released.html Alpine 3.7.0 new mayor release]''', preliminary support in that version does not create the
! Architecture
[https://en.wikipedia.org/wiki/EFI_system_partition EFI Partition], only has support for existing ones or manually created.
! Named Bootloader
! Fallback Bootloader
|-
| x86_64
| {{Path|\EFI\alpine\grubx64.efi}}
| {{Path|\EFI\boot\bootx64.efi}}
|-
| x86 (32-bit)
| {{Path|\EFI\alpine\grubia32.efi}}
| {{Path|\EFI\boot\bootia32.efi}}
|-
| arm*
| {{Path|\EFI\alpine\grubarm.efi}}
| {{Path|\EFI\boot\bootarm.efi}}
|-
| aarch64 (ARM64)
| {{Path|\EFI\alpine\grubaa64.efi}}
| {{Path|\EFI\boot\bootaa64.efi}}
|-
| riscv64
| {{Path|\EFI\alpine\grubriscv64.efi}}
| {{Path|\EFI\boot\bootriscv64.efi}}
|-
| loongarch64
| {{Path|\EFI\alpine\grubloongarch64.efi}}
| {{Path|\EFI\boot\bootloongarch64.efi}}
|}
 
== UEFI boot process ==
 
UEFI has list of possible boot entries, stored in UEFI config variables (normally in NVRAM), and boot order config variables stored alongside them.  UEFI firmware can read ESP partition, a UDF or FAT32-formatted USB drive or DVD, and look for OS boot loaders and runs it.
 
These boot entries in NVRAM can be viewed and edited with [[Bootloaders#efibootmgr|efibootmgr]] utility.
 
== BIOS boot process ==
 
BIOS mainly supports two methods of booting - loading approximately 448 bytes of 8088 machine code from the start of a floppy disk, or the same from the start of a fixed disk.  BIOS can only assume one boot loader occupying the start of hard drive. So each OS overwrites it with its own boot loader.  
 
MBR cannot handle disks larger than 2 TiB (2<sup>32</sup> × 512 bytes). Therefore, it is impossible to use any drive space beyond 2 TiB using MBR layout.  


Started '''in the [https://alpinelinux.org/posts/Alpine-3.8.0-released.html Alpine 3.8.0 new mayor release] support in the installer for the GRUB boot loader was added''' so now Linux experimental users can play with combinations of solutions and proper
BIOS is '''deprecated''' since approximately 2011 onwards and modern motherboards are using UEFI.
[https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface UEFI] complete installations. Please refer to [[Alpine_and_UEFI#UEFI_and_BIOS_definitions_and_introduction|UEFI_and_BIOS section of this page]] first.


[https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface#EFI_system_partition EFI System Partition] are not the complete overall of the [https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface UEFI], it's just the need minimal infrastructure to property boot by and [https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface#Implementation_and_adoption UEFI modern machine].
== Secure boot process ==
{{Main|UEFI Secure Boot}}


Please read carefully the [[Alpine_and_UEFI#UEFI_and_BIOS_definitions_and_introduction|UEFI_and_BIOS section of this page]].
When the device is powered ON, secure boot checks the digital signatures of the bootloader and operating system. If the signatures are valid and match the trusted keys stored in the system, the boot process continues. If not, secure boot halts the process to protect against tampering.  


== Minimum Alpine partition sheme ==
Almost all X86 based motherboard has a small list of pre-trusted certificates which includes Microsoft's certificates, which they currently let anyone use for a small fee as a Certification Authority (CA).


Alpine Linux only require a root partition for system and a swap partition, but, UEFI systems require an EFI system partition.
Alpine Linux does not have a certificate which some other Linux distributions (mostly enterprise-related) have.  


== Notes about the boot flags and boot partition ==
{{Tip| To install Alpine Linux ''' Disable''' Secure boot in the UEFI firmware. It can be enabled after Alpine Linux is installed.}}


UEFI booting does not involve any "boot" flag, that's it's a need only for BIOS booting. The UEFI booting relies solely on the boot entries in NVRAM. Parted and its front-ends use a "boot" flag on GPT to indicate that a partition is an EFI system partition.
[[UEFI Secure Boot]] page explains how to generate your own UEFI keys and enrolling those UEFI keys to be used with a Unified Kernel Image.


A BIOS boot partition is only required when using GRUB for BIOS booting from a GPT disk. The partition has nothing to do and it must not be formatted with a file system or mounted.
== Disk layout and UEFI ==


== Alpine disk layout for UEFI ==
[[#UEFI-GPT layout|UEFI-GPT layout]] is the recommended layout for UEFI. UEFI relies on the boot entries in NVRAM and looks for OS bootloaders and runs it.


You will need a disk layout that your system firmware is capable of booting, you '''will need a boot partition and a root partition'''. Other architectures may have different requirements.
=== UEFI-GPT layout ===


If you don't already know what filesystem format you want your boot partition, choose '''ext2'''. The '''root partition, and any additional partitions or LVM volume groups, may be in any format that the kernel is capable of reading'''.
Booting UEFI systems from GPT-partitioned disks is commonly called UEFI-GPT booting. On GPT disks, the EFI System Partition is identified by its partition type GUID (C12A7328-F81F-11D2-BA4B-00A0C93EC93B).  


==== UEFI/GPT minimal layout ====
On UEFI systems, Alpine Linux requires an EFI System Partition(ESP) in addition to the (/) root partition. A minimal UEFI-GPT layout is given below:


{| class="wikitable"
{| class="wikitable"
Line 46: Line 87:
! Partition
! Partition
! Partition type Purpose
! Partition type Purpose
! Recommended size
! Recommended minimum size
|-
|-
| /boot or /efi
| /efi or /boot/efi or /boot
| /dev/sda1
| /dev/sda1
| Boot system partition for EFI
| EFI system partition
| 260 MiB
| 260 MiB
|-
|-
Line 57: Line 98:
| Alpine Linux root system OS
| Alpine Linux root system OS
| 1–32 GiB
| 1–32 GiB
|-
| none
| /dev/sda3
| Linux swap memory
| 1-2Gb
|}
|}


==== BIOS/MBR minimal layout ====
=== BIOS-MBR layout ===
 
BIOS-style booting from MBR-partitioned disks is called BIOS-MBR, regardless of it being performed on UEFI or legacy BIOS-based systems. Such a boot scheme is commonly called UEFI-MBR. 
 
Despite the fact that the UEFI specification requires MBR partition tables to be fully supported, some UEFI firmware implementations may immediately switch to BIOS-based Compatibility Support Module (CSM) booting depending on the type of boot disk's partition table, effectively preventing UEFI booting to be performed from EFI System Partition on MBR-partitioned disks.  CSM is a deprecated feature as of late 2020's.
 
'''Use this only on legacy motherboards using [[#BIOS boot process|BIOS boot process ]]'''. A BIOS boot partition with "boot" flag is required when using this layout.


{| class="wikitable"
{| class="wikitable"
Line 70: Line 112:
! Partition
! Partition
! Partition type Purpose
! Partition type Purpose
! Recommended size
! Recommended minimum size
|-
|-
| /boot
| /boot
Line 81: Line 123:
| Alpine Linux root system OS
| Alpine Linux root system OS
| 1–32 GiB
| 1–32 GiB
|-
| none
| /dev/sda3
| Linux swap memory
| 1-2Gb
|}
|}


==== BIOS/GPT minimal layout ====
=== BIOS-GPT layout ===
 
Booting legacy BIOS-based systems from GPT disks is also possible, and such a boot scheme is commonly called BIOS-GPT. A BIOS boot partition with "boot" flag is required when using this layout. This partition must '''not''' be formatted with a file system or mounted.


{| class="wikitable"
{| class="wikitable"
Line 94: Line 133:
! Partition
! Partition
! Partition type Purpose
! Partition type Purpose
! Recommended size
! Recommended minimum size
|-
|-
| None
| None
Line 105: Line 144:
| Alpine Linux root system OS
| Alpine Linux root system OS
| 1–32 GiB
| 1–32 GiB
|-
 
| none
| /dev/sda3
| Linux swap memory
| 1-2Gb
|}
|}


== See Also ==
== See also ==
 
* [[Alpine_newbie_install_manual|Alpine Installation]]
* [[Create a Bootable Compact Flash]]
* [[Create a bootable SDHC from a Mac]]
* [[Create a Bootable USB]]
* [[Create UEFI boot USB]]
* [[Create UEFI seureboot USB]]
 
= BIOS boot process for newbies =
 
BIOS only supports two methods of booting - loading 448ish bytes of 8088 machine code from the start of a floppy disk, or the same from the start of a fixed IDE disk
 
BIOS can only assume one boot loader occupying the start of hard drive. So each OS overwrites it with its own boot loader. Messy messy. There's also the 2TB issue I mentioned before
 
In order to make your drive more useful, it's split up into partitions - chunks of disk which can be treated as independent drives from inside your OS. Ruindows (following on from MS-DOS) only supports one method for partitioning its boot drive on BIOS systems: "MBR"
 
MBR cannot handle numbers bigger than 2,199,023,255,552. It is impossible to talk about any drive beyond 2TB using MBR layout. So if you're booting from it and use BIOS, you MUST use MBR (because that's all Windows supports) - and you simply can't use any space beyond that if your boot drive is 3TB or bigger.
 
For now. Ish. Any modern motherboard (some 2011 onwards, all with a Ruindows 8 logo on the box) is using UEFI natively, but most can emulate BIOS enough for you to keep booting with BIOS.
 
== How to choose BIOS Boot options media ==
 
WIP due we nee a very easy way to tell this
 
= UEFI boot process for newbies.. i mean for complications =
 
Well, let's start with installers. It'll read a UDF or FAT32-formatted USB drive or DVD, and look for the file /efi/boot/bootx64.efi and run it. An app, written in the UEFI "OS". It can be anything! Here's classic text adventure Zork, as a UEFI app.
 
It's possible to make boot media which is valid for both UEFI and BIOS. Unfortunately, in a slightly user-unfriendly twist, you (the user) need to pick the right boot entry. For example, on the wife's PC, a USB stick gets listed as both "UEFI: Sandisk Cruzer Edge" and "USB: Sandisk Cruzer Edge". Just... make sure you pick the right entry. It's impossible to change mode after this point.
 
It uses a different partitioning system called GPT instead of MBR, and secondly it creates an extra ~100 meg partition called the "EFI System Partition" - a FAT32 partition where the boot loader apps get installed to (no more boot sectors).
 
Each OS will stick its boot loader somewhere in the ESP, then send a signal to the firmware to write this new loader's location into the CMOS. Each entry installed in this manner will get its own listing in your "boot devices" list on the firmware - so if you installed MACOSX, you'll have "MACOSX Boot Manager" as an entry next to your DVD drive and hard drive after you reboot. This is why you don't do the old "unplug drive A when installing a different OS to drive B" thing, or swap cables, or anything like that. You should only have one ESP, the one on drive A.
 
== What's this infamous "secure boot" ==
 
It's a way for your motherboard to prevent tampering of your OS (e.g. boot-sector viruses, or backdoors installed without your knowledge). You can provide a list of certificates you trust, then the firmware enforces that everything involved with the boot process (not just the boot loader, but the OS kernel itself, and all your device firmware like your GPU BIOS) are signed with a trusted key.
 
It stops your system from booting unsigned code. You can sign your own, and trust the certificate you used to do that signing. Or you can get the boot code signed by Microsoft - every motherboard has a small list of pre-trusted certificates which almost always includes Microsoft's cert, which they currently let anyone use for a small fee.
 
== How to boot unsigned code? ==
 
You usually can disable Secure Boot.
 
= Overall notes and conclusions =
 
= See Also =
 
* [[Newbie_Alpine_Ecosystem]]
* [[Alpine_newbie_install_manual|Alpine Installation]]
* [[Create a Bootable Compact Flash]]
* [[Create a bootable SDHC from a Mac]]
* [[Create a Bootable USB]]
* [[Create UEFI boot USB]]
* [[Create UEFI seureboot USB]]


[[Category:Newbie]]
* [[UEFI_Secure_Boot|How to enable secure boot]]
[[Category:Installation]]
* [[Bootloaders]]
* [[Create UEFI secureboot USB]]
* [[Setting_up_disks_manually#Manual_partitioning | Manual partitioning]]
* [https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface UEFI - Archwiki]
* [https://en.wikipedia.org/wiki/EFI_system_partition EFI System Partition - Wikipedia]  
[[Category:Installation]][[Category:UEFI]]

Latest revision as of 16:58, 1 November 2025

Unified Extensible Firmware Interface(UEFI) is a specification for the firmware architecture of a computing platform. This page documents how Alpine Linux works with devices using UEFI firmware.

EFI system partition

UEFI requires a partition called "EFI System Partition" (ESP) - a FAT32 partition where the OS bootloader apps get installed to. This is also commonly known as ESP partition.

The UEFI specification defines a standard boot path for systems without NVRAM entries as follows: 

 <EFI_SYSTEM_PARTITION>\EFI\BOOT\BOOT<MACHINE_TYPE_SHORT_NAME>.EFI

Most of the programs that are expected to run in the UEFI environment are bootloaders, but other utilities might exist too. There are also programs to deal with firmware updates from motherboard manufacturers which can run before operating system startup like fwupdate/fwupd.

EFI bootloaders

When installing Alpine linux in System Disk Mode, the setup-disk script creates both a named bootloader (in \EFI\alpine\) and a copy at the standard boot path (in \EFI\boot\) for all architectures as shown in the below table. The installation script does not create NVRAM boot entries.

Architecture Named Bootloader Fallback Bootloader
x86_64 \EFI\alpine\grubx64.efi \EFI\boot\bootx64.efi
x86 (32-bit) \EFI\alpine\grubia32.efi \EFI\boot\bootia32.efi
arm* \EFI\alpine\grubarm.efi \EFI\boot\bootarm.efi
aarch64 (ARM64) \EFI\alpine\grubaa64.efi \EFI\boot\bootaa64.efi
riscv64 \EFI\alpine\grubriscv64.efi \EFI\boot\bootriscv64.efi
loongarch64 \EFI\alpine\grubloongarch64.efi \EFI\boot\bootloongarch64.efi

UEFI boot process

UEFI has list of possible boot entries, stored in UEFI config variables (normally in NVRAM), and boot order config variables stored alongside them. UEFI firmware can read ESP partition, a UDF or FAT32-formatted USB drive or DVD, and look for OS boot loaders and runs it.

These boot entries in NVRAM can be viewed and edited with efibootmgr utility.

BIOS boot process

BIOS mainly supports two methods of booting - loading approximately 448 bytes of 8088 machine code from the start of a floppy disk, or the same from the start of a fixed disk. BIOS can only assume one boot loader occupying the start of hard drive. So each OS overwrites it with its own boot loader.

MBR cannot handle disks larger than 2 TiB (232 × 512 bytes). Therefore, it is impossible to use any drive space beyond 2 TiB using MBR layout.

BIOS is deprecated since approximately 2011 onwards and modern motherboards are using UEFI.

Secure boot process

Main article: UEFI Secure Boot

When the device is powered ON, secure boot checks the digital signatures of the bootloader and operating system. If the signatures are valid and match the trusted keys stored in the system, the boot process continues. If not, secure boot halts the process to protect against tampering.

Almost all X86 based motherboard has a small list of pre-trusted certificates which includes Microsoft's certificates, which they currently let anyone use for a small fee as a Certification Authority (CA).

Alpine Linux does not have a certificate which some other Linux distributions (mostly enterprise-related) have.

Tip: To install Alpine Linux Disable Secure boot in the UEFI firmware. It can be enabled after Alpine Linux is installed.

UEFI Secure Boot page explains how to generate your own UEFI keys and enrolling those UEFI keys to be used with a Unified Kernel Image.

Disk layout and UEFI

UEFI-GPT layout is the recommended layout for UEFI. UEFI relies on the boot entries in NVRAM and looks for OS bootloaders and runs it.

UEFI-GPT layout

Booting UEFI systems from GPT-partitioned disks is commonly called UEFI-GPT booting. On GPT disks, the EFI System Partition is identified by its partition type GUID (C12A7328-F81F-11D2-BA4B-00A0C93EC93B).

On UEFI systems, Alpine Linux requires an EFI System Partition(ESP) in addition to the (/) root partition. A minimal UEFI-GPT layout is given below:

Mount point Partition Partition type Purpose Recommended minimum size
/efi or /boot/efi or /boot /dev/sda1 EFI system partition 260 MiB
/ /dev/sda2 Alpine Linux root system OS 1–32 GiB

BIOS-MBR layout

BIOS-style booting from MBR-partitioned disks is called BIOS-MBR, regardless of it being performed on UEFI or legacy BIOS-based systems. Such a boot scheme is commonly called UEFI-MBR.

Despite the fact that the UEFI specification requires MBR partition tables to be fully supported, some UEFI firmware implementations may immediately switch to BIOS-based Compatibility Support Module (CSM) booting depending on the type of boot disk's partition table, effectively preventing UEFI booting to be performed from EFI System Partition on MBR-partitioned disks. CSM is a deprecated feature as of late 2020's.

Use this only on legacy motherboards using BIOS boot process . A BIOS boot partition with "boot" flag is required when using this layout.

Mount point Partition Partition type Purpose Recommended minimum size
/boot /dev/sda1 Boot grub partition (optional) 100 MiB
/ /dev/sda2 Alpine Linux root system OS 1–32 GiB

BIOS-GPT layout

Booting legacy BIOS-based systems from GPT disks is also possible, and such a boot scheme is commonly called BIOS-GPT. A BIOS boot partition with "boot" flag is required when using this layout. This partition must not be formatted with a file system or mounted.

Mount point Partition Partition type Purpose Recommended minimum size
None /dev/sda1 BIOS boot partition 8 MiB
/ /dev/sda2 Alpine Linux root system OS 1–32 GiB

See also

Retrieved from "https://wiki.alpinelinux.org/w/index.php?title=UEFI&oldid=31347"