[gentoo-user] New PC, new boot concepts

[gentoo-user] New PC, new boot concepts

[Mick]

[-- Attachment #1: Type: Text/Plain, Size: 2135 bytes --]

Old dogs and new tricks springs to mind.  I am building a new PC and what with 
UEFI, APUs and SSDs, it feels like that the world has moved a long way since 
the last time I had to install gentoo.

I'll be taking my time to google, read and make appropriate selections, so 
please bear with me while I start relevant threads as necessary to complement 
my sparse knowledge in these topics.  Starting from the top, with this thread 
I am trying to find out what is considered good practice as far as UEFI/MBR 
and boot management goes.

The MoBo is capable of booting in CMS mode, but I am not sure if there are any 
benefits in creating a 2MB partition for a conventional MBR bootloader, or I 
should forego MBR altogether and go directly with a GPT FAT32 EFI System 
Partition (ESP).

If the latter is the way to go and I forget all things I ever learned about 
MBR, does the 550MB FAT32 ESP partition have to be at the beginning of the 
drive?

Is it beneficial to install a Linux boot loader/manager like GRUB2, or rEFInd, 
etc., or should I just use the kernel EFI Boot Stub to boot gentoo with?  The 
PC will single boot in Gentoo, although I may drop in a sysrescuecd image for 
recovery purposes and would be nice to be able to boot this straight off the 
disk, without having to burn it on a CDROM.  Is it simply a matter of adding 
the LiveCD iso in the ESP with a .efi suffix, or will I need to use efibootmgr 
to inform the UEFI about *any* kernel images in the ESP other than the default 
EFI/BOOT/bootx64.efi?

Finally, what's your opinion on 'secure boot'?  I'm mostly thinking of its 
benefit as a pre-boot malware protection utility, but I don't want to 
introduce too much complexity which may make recovery of my data difficult in 
the future.  I've heard some horror stories resulting from NVRAM corruption, 
or flashing with new UEFI firmware rendering the PC unbootable, etc. but don't 
know if this is due to user error.  If you have experience using secure boot 
what is your preferred method?

Any other pointers and gotchas I should be careful with?

-- 
Regards,
Mick

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 473 bytes --]

Re: [gentoo-user] New PC, new boot concepts

[Todd Goodman]

* Mick <michaelkintzios@gmail.com> [141219 10:22]:
[SNIP]
> I am trying to find out what is considered good practice as far as UEFI/MBR 
> and boot management goes.

FWIW, I've built recent machines with UEFI/GPT but I mostly build recent
machines using BIOS-mode/GPT or MBR.  It usually depends on how well the
mobo I'm using works with either.

Some of the mobos I've used have some seriously crummy UEFI
implementations that look like they installed Windows and that worked so
didn't bother testing any further.

I don't dual-boot windows so BIOS/GPT works OK (I believe windows still
assumes UEFI == GPT and BIOS == MBR but I don't know.)

Obviously I'm not using secure boot if I'm running in BIOS mode.

Just my $.02,

Todd

Re: [gentoo-user] New PC, new boot concepts

[Mick]

[-- Attachment #1: Type: Text/Plain, Size: 1003 bytes --]

On Friday 19 Dec 2014 15:46:43 Todd Goodman wrote:
> * Mick <michaelkintzios@gmail.com> [141219 10:22]:
> [SNIP]
> 
> > I am trying to find out what is considered good practice as far as
> > UEFI/MBR and boot management goes.
> 
> FWIW, I've built recent machines with UEFI/GPT but I mostly build recent
> machines using BIOS-mode/GPT or MBR.  It usually depends on how well the
> mobo I'm using works with either.
> 
> Some of the mobos I've used have some seriously crummy UEFI
> implementations that look like they installed Windows and that worked so
> didn't bother testing any further.
> 
> I don't dual-boot windows so BIOS/GPT works OK (I believe windows still
> assumes UEFI == GPT and BIOS == MBR but I don't know.)
> 
> Obviously I'm not using secure boot if I'm running in BIOS mode.
> 
> Just my $.02,

Thanks Todd,

Are you saying that there is no benefit in moving to UEFI for Linux usage, if 
the MoBo can boot in conventional BIOS mode?

-- 
Regards,
Mick

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 473 bytes --]

Re: [gentoo-user] New PC, new boot concepts

[Todd Goodman]

* Mick <michaelkintzios@gmail.com> [141219 11:13]:
> On Friday 19 Dec 2014 15:46:43 Todd Goodman wrote:
> > * Mick <michaelkintzios@gmail.com> [141219 10:22]:
> > [SNIP]
> > 
> > > I am trying to find out what is considered good practice as far as
> > > UEFI/MBR and boot management goes.
> > 
> > FWIW, I've built recent machines with UEFI/GPT but I mostly build recent
> > machines using BIOS-mode/GPT or MBR.  It usually depends on how well the
> > mobo I'm using works with either.
> > 
> > Some of the mobos I've used have some seriously crummy UEFI
> > implementations that look like they installed Windows and that worked so
> > didn't bother testing any further.
> > 
> > I don't dual-boot windows so BIOS/GPT works OK (I believe windows still
> > assumes UEFI == GPT and BIOS == MBR but I don't know.)
> > 
> > Obviously I'm not using secure boot if I'm running in BIOS mode.
> > 
> > Just my $.02,
> 
> Thanks Todd,
> 
> Are you saying that there is no benefit in moving to UEFI for Linux usage, if 
> the MoBo can boot in conventional BIOS mode?

I guess what I'm saying is that I've had problems with some mobos
running UEFI (and also BIOS) with any non-windows OS.

So I don't usually bother with UEFI mode anymore as I find it more
hassle than it's worth for me.

Someone else may (probably) has some reasons why running UEFI is more
beneficial, but I haven't noticed any.

But these machines are not booting any other OS aside from Gentoo.  If I
were dual-booting Windows then I'd go UEFI/GPT for sure.

Todd

Re: [gentoo-user] New PC, new boot concepts

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 1777 bytes --]

On Fri, 19 Dec 2014 15:22:04 +0000, Mick wrote:

> The MoBo is capable of booting in CMS mode, but I am not sure if there
> are any benefits in creating a 2MB partition for a conventional MBR
> bootloader, or I should forego MBR altogether and go directly with a
> GPT FAT32 EFI System Partition (ESP).
> 
> If the latter is the way to go and I forget all things I ever learned
> about MBR, does the 550MB FAT32 ESP partition have to be at the
> beginning of the drive?

Yes, it should be sda1. You can also use this partition as /boot, and
should do so if you use Gummiboot.

> Is it beneficial to install a Linux boot loader/manager like GRUB2, or
> rEFInd, etc., or should I just use the kernel EFI Boot Stub to boot
> gentoo with?

I use a bootloader, gummiboot, as it makes it easy to select different
options when booting.

> The PC will single boot in Gentoo, although I may drop in
> a sysrescuecd image for recovery purposes and would be nice to be able
> to boot this straight off the disk, without having to burn it on a
> CDROM.  Is it simply a matter of adding the LiveCD iso in the ESP with
> a .efi suffix, or will I need to use efibootmgr to inform the UEFI
> about *any* kernel images in the ESP other than the default
> EFI/BOOT/bootx64.efi?

I still use GRUB to boot ISO images, and have a sysrescd image in /boot
for this. With UEFI, you can have more than one bootloader installed. I
hadn't considered the possibility of UEFI booting to an ISO directly, I'd
be interested to know if it is possible.

> Finally, what's your opinion on 'secure boot'?

That the main security is is aimed at is job security for MS employees. I
turn it off straight away.


-- 
Neil Bothwick

Top Oxymorons Number 44: Advanced BASIC

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

Re: [gentoo-user] New PC, new boot concepts

[Sid S]

> I still use GRUB to boot ISO images, and have a sysrescd image in /boot
> for this. With UEFI, you can have more than one bootloader installed. I
> hadn't considered the possibility of UEFI booting to an ISO directly, I'd
> be interested to know if it is possible.

Typically one takes the contents of the iso, places that on a partition,
and then makes it bootable with grub. I'm not sure you can boot the iso
directly.

>> Finally, what's your opinion on 'secure boot'?
>
> That the main security is is aimed at is job security for MS employees. I
> turn it off straight away.

It is not a completely stupid idea. When it is adequately supported it is
something I intend to use. It is possible (unless I misunderstood
something) to provide your own keys and sign your own OS partition.


Anyway, I am kind of surprised people are still having problems with UEFI.
It's necessary to turn SecureBoot off, but otherwise I just got everything to
work.

Re: [gentoo-user] New PC, new boot concepts

[Rich Freeman]

On Fri, Dec 19, 2014 at 9:03 PM, Sid S <r030t1@gmail.com> wrote:
>
> Anyway, I am kind of surprised people are still having problems with UEFI.
> It's necessary to turn SecureBoot off, but otherwise I just got everything to
> work.
>

I've yet to do an EFI install, but presumably you could either sign
the kernel or bootloader and load the key you used into the firmware
(which is required to be supported for Microsoft compliance, so if it
doesn't work you might consider mentioning it to Microsoft in the hope
that they yank the Windows logo from the machine), or you could load
an MS-signed shim which I believe exists.  The latter is probably
preferable as it basically gives you a secondary bootloader which
makes the system a bit more flexible, but it still protects you from
boot manipulation since the shim requires physical keyboard presence
to change the boot config.

I wouldn't completely discount secure boot - if you can configure it
then it actually can be a powerful tool to give you more control over
your own machine, much like a TPM.

--
Rich

Re: [gentoo-user] New PC, new boot concepts

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 1331 bytes --]

On 20 December 2014 02:03:41 GMT+00:00, Sid S <r030t1@gmail.com> wrote:
> > I still use GRUB to boot ISO images, and have a sysrescd image in
> /boot
> > for this. With UEFI, you can have more than one bootloader
> installed. I
> > hadn't considered the possibility of UEFI booting to an ISO
> directly, I'd
> > be interested to know if it is possible.
> 
> Typically one takes the contents of the iso, places that on a
> partition,
> and then makes it bootable with grub. I'm not sure you can boot the
> iso
> directly.
> 
> >> Finally, what's your opinion on 'secure boot'?
> >
> > That the main security is is aimed at is job security for MS
> employees. I
> > turn it off straight away.
> 
> It is not a completely stupid idea. When it is adequately supported it
> is
> something I intend to use. It is possible (unless I misunderstood
> something) to provide your own keys and sign your own OS partition.
> 
> 
> Anyway, I am kind of surprised people are still having problems with
> UEFI.
> It's necessary to turn SecureBoot off, but otherwise I just got
> everything to
> work.

You can boot an ISO directly with GRUB2, no need to unpack anything  I've been doing it for years. I would be interested to know if is is possible with UEFI but without GRUB
-- 
Sent from my Android phone with K-9 Mail. Please excuse my brevity.

[-- Attachment #2: Type: text/html, Size: 2040 bytes --]

Re: [gentoo-user] New PC, new boot concepts

[Daniel Frey]

On 12/19/2014 07:22 AM, Mick wrote:
> I'll be taking my time to google, read and make appropriate selections, so 
> please bear with me while I start relevant threads as necessary to complement 
> my sparse knowledge in these topics.  Starting from the top, with this thread 
> I am trying to find out what is considered good practice as far as UEFI/MBR 
> and boot management goes.

I got myself an Intel NUC some months ago and ran into this problem. I
wound up using UEFI+GPT with grub2 and had no issues, other than
learning new grub2 syntax. I didn't like the idea of it scanning
automatically and adding new entries.

> The MoBo is capable of booting in CMS mode, but I am not sure if there are any 
> benefits in creating a 2MB partition for a conventional MBR bootloader, or I 
> should forego MBR altogether and go directly with a GPT FAT32 EFI System 
> Partition (ESP).

Keep in mind that your motherboard may have to boot in UEFI to get
access to features. For example, my NUC's hdmi audio will not work
booted in CMS mode.

> If the latter is the way to go and I forget all things I ever learned about 
> MBR, does the 550MB FAT32 ESP partition have to be at the beginning of the 
> drive?
> 
> Is it beneficial to install a Linux boot loader/manager like GRUB2, or rEFInd, 
> etc., or should I just use the kernel EFI Boot Stub to boot gentoo with?  The 
> PC will single boot in Gentoo, although I may drop in a sysrescuecd image for 
> recovery purposes and would be nice to be able to boot this straight off the 
> disk, without having to burn it on a CDROM.  Is it simply a matter of adding 
> the LiveCD iso in the ESP with a .efi suffix, or will I need to use efibootmgr 
> to inform the UEFI about *any* kernel images in the ESP other than the default 
> EFI/BOOT/bootx64.efi?

I found it useful to have grub2 for testing new kernels. I set up this
box mostly as an appliance (mythtv frontend) but sometimes booting to
recovery etc is useful. Especially since you can boot a Mint ISO with
UEFI support when something barfs.

> Finally, what's your opinion on 'secure boot'?  I'm mostly thinking of its 
> benefit as a pre-boot malware protection utility, but I don't want to 
> introduce too much complexity which may make recovery of my data difficult in 
> the future.  I've heard some horror stories resulting from NVRAM corruption, 
> or flashing with new UEFI firmware rendering the PC unbootable, etc. but don't 
> know if this is due to user error.  If you have experience using secure boot 
> what is your preferred method?

I didn't bother with it.

> 
> Any other pointers and gotchas I should be careful with?

Only thing I screwed up with when messing around with my new NUC was I
set the grub platform incorrectly. I used pc-x86_64 instead of efi-64 (I
think, it's been a while.) Once I had the grub platform set properly the
install went well.

Dan

Re: [gentoo-user] New PC, new boot concepts

[Tom H]

On Fri, Dec 19, 2014 at 10:22 AM, Mick <michaelkintzios@gmail.com> wrote:
>
> Old dogs and new tricks springs to mind. I am building a new PC and what with
> UEFI, APUs and SSDs, it feels like that the world has moved a long way since
> the last time I had to install gentoo.
>
> I'll be taking my time to google, read and make appropriate selections, so
> please bear with me while I start relevant threads as necessary to complement
> my sparse knowledge in these topics. Starting from the top, with this thread
> I am trying to find out what is considered good practice as far as UEFI/MBR
> and boot management goes.
>
> The MoBo is capable of booting in CMS mode, but I am not sure if there are any
> benefits in creating a 2MB partition for a conventional MBR bootloader, or I
> should forego MBR altogether and go directly with a GPT FAT32 EFI System
> Partition (ESP).
>
> If the latter is the way to go and I forget all things I ever learned about
> MBR, does the 550MB FAT32 ESP partition have to be at the beginning of the
> drive?
>
> Is it beneficial to install a Linux boot loader/manager like GRUB2, or rEFInd,
> etc., or should I just use the kernel EFI Boot Stub to boot gentoo with? The
> PC will single boot in Gentoo, although I may drop in a sysrescuecd image for
> recovery purposes and would be nice to be able to boot this straight off the
> disk, without having to burn it on a CDROM. Is it simply a matter of adding
> the LiveCD iso in the ESP with a .efi suffix, or will I need to use efibootmgr
> to inform the UEFI about *any* kernel images in the ESP other than the default
> EFI/BOOT/bootx64.efi?

For refind and gummiboot, you have to enable the efi boot stub because
they're boot managers, rather than boot loaders like grub.

If you want to use the efi boot stub, whether directly or via
gummiboot or refind, you have to have the kernel (and initramfs if it
exists) on a fat partition. Unlike with bios firmware, you can have
them all co-exist.

AFAIK only grub can boot from an iso file. You have to have a
"loopback loop path_to_iso_file" line (which I think of as a "mount -o
loop ...") in that iso's menuentry stanza. And its "linux ..." line
will be dependent on the iso from which you're booting. The
systemrescue iso needs either "findiso=..." or "isoloop=...", I've
forgotten.

Re: [gentoo-user] New PC, new boot concepts

[Tom H]

On Fri, Dec 19, 2014 at 11:12 AM, Mick <michaelkintzios@gmail.com> wrote:
> On Friday 19 Dec 2014 15:46:43 Todd Goodman wrote:
>> * Mick <michaelkintzios@gmail.com> [141219 10:22]:
>>
>>> I am trying to find out what is considered good practice as far as
>>> UEFI/MBR and boot management goes.
>>
>> FWIW, I've built recent machines with UEFI/GPT but I mostly build recent
>> machines using BIOS-mode/GPT or MBR.  It usually depends on how well the
>> mobo I'm using works with either.
>>
>> Some of the mobos I've used have some seriously crummy UEFI
>> implementations that look like they installed Windows and that worked so
>> didn't bother testing any further.
>>
>> I don't dual-boot windows so BIOS/GPT works OK (I believe windows still
>> assumes UEFI == GPT and BIOS == MBR but I don't know.)
>
> Are you saying that there is no benefit in moving to UEFI for Linux usage, if
> the MoBo can boot in conventional BIOS mode?

The advantage of efi over bios is that the boot loader doesn't have to
embed anything in the mbr, the post mbr gap, or the bios boot
partition.

Re: [gentoo-user] New PC, new boot concepts

[behrouz khosravi]

[-- Attachment #1: Type: text/plain, Size: 472 bytes --]

>
>
> The advantage of efi over bios is that the boot loader doesn't have to
> embed anything in the mbr, the post mbr gap, or the bios boot
> partition.
>
>
I just wanted to say that there is another advantage too!
MS WIndows7 support booting from GPT partition tables,
only if you are using the UEFI. (I dont know about Windows8)
I wanted to use GPT on a dual boot system, so I enabled UEFI on my laptop,
and I am using GRUB2 as bootloader.
Everything is working great.

[-- Attachment #2: Type: text/html, Size: 942 bytes --]

Re: [gentoo-user] New PC, new boot concepts

[J. Roeleveld]

On Saturday, December 20, 2014 11:10:26 PM behrouz khosravi wrote:
> > The advantage of efi over bios is that the boot loader doesn't have to
> > embed anything in the mbr, the post mbr gap, or the bios boot
> > partition.
> 
> I just wanted to say that there is another advantage too!
> MS WIndows7 support booting from GPT partition tables,
> only if you are using the UEFI. (I dont know about Windows8)
> I wanted to use GPT on a dual boot system, so I enabled UEFI on my laptop,
> and I am using GRUB2 as bootloader.
> Everything is working great.

Just to add a little extra detail before others run into the same.

Not ALL UEFI systems work with MS Windows 7. Without a compatibility part for 
the VGA-console, the install will fail.

--
Joost

Re: [gentoo-user] New PC, new boot concepts

[behrouz khosravi]

[-- Attachment #1: Type: text/plain, Size: 243 bytes --]

>
>
> Just to add a little extra detail before others run into the same.
>
> Not ALL UEFI systems work with MS Windows 7. Without a compatibility part
> for
> the VGA-console, the install will fail.
>
>
I didnt know that. Thanks for the info.

[-- Attachment #2: Type: text/html, Size: 494 bytes --]

Re: [gentoo-user] New PC, new boot concepts

[J. Roeleveld]

On 21 December 2014 15:28:26 CET, behrouz khosravi <bz.khosravi@gmail.com> wrote:
>>
>>
>> Just to add a little extra detail before others run into the same.
>>
>> Not ALL UEFI systems work with MS Windows 7. Without a compatibility
>part
>> for
>> the VGA-console, the install will fail.
>>
>>
>I didnt know that. Thanks for the info.

I didn't either till I encountered it on my laptop. Don't care enough to make a problem about it with the suplier.
-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.