Creating UEFI boot on a computer with windows 8.1 and Kubuntu already installed

[Qqmike]

xennex81,

Will refind allow you to customize the boot menu you get? ... [etc.] ...

Some of these ideas seem--to me--to be unnecessary, complicated, just to boot stuff up. In any case, though, rather than in this thread, why not make some suggestions and rationale directly to Rod Smith through his website. I'm sure he'd consider any sincere suggestions.

[geezer]

Plan for converting to UEFI boot from MBR:


I have already used cgdisk to convert all HDD to gpt type from msdos type. cgdisk
accomplished the conversion automatically when booted. Even converted both of my
USB external hdd. cgdisk is very easy to use and worked very well for me.

I converted sda and almost panicked when I could no longer boot
since cgdisk deleted the MBR in the conversion - I had forgotten about that. "Almost"
panicked since I had used 'dd' to copy the the MBR and partition table to the external
hard disk. Booted Kubuntu Live and used dd to copy the MBR only back. Uh Oh. It wouldn't
boot. Then I realized that the MBR for an msdos partition table is probably very different
than for a gpt partition table. Booted Kubuntu Live again and installed Boot-Repair and
ran that. Rebooted fine except Boot-Repair knows nothing about gpt partitions and so
converted sda back to msdos from gpt. I vaguely remember that Boot-Repair will not
boot on a UEFI computer. That is probably why cgdisk deletes the MBR on the conversion.
So doing a simple msdos to gpt conversion on the boot disk will not suffice. Have to
get more complicated.

Thus, the following plan.

Use sda, SSD 111 GB for the EFI partition, my '/' and '/home' partitions.

I will allocate 350 MB for the ESP partition which is slightly larger than the
300 MB used on the laptop by Acer of which only 64 MB is used.

I will allocate 16 GB for the '/' partition. Currently all of the SSD is used for
'/' and only a 8.85 GB is used. 16 GB should leave room for the '/ directory to
expand.

That leaves 93 GB to 94 GB for the '/home' directory. Currently that directory uses
62.5 GB so that leaves a little room for expansion there. I can always move a sub-directory
to an hdd if needed.

My planned procedure - comments are appreciated, especially if I am making a big
mistake somewhere or there is a better way to do this.

1: (re)boot and start Setup (commonly called BIOS)
2: change boot mode from 'UEFI+Legacy' to 'UEFI'
3: save and exit, booting Kubuntu Live on DVD or USB device
4: choose "Try Kubuntu"
5: install Gparted and gdisk
6: use Gparted to create a partition table for sda - gpt type
7: use Gparted to add 3 partitions on sda:
1) sda1, 350 MB, efi type partition, "EFI" partition label
2: sda2, 16 GB, ext4. mount point, '/'.
3: sda3, remaining free space, approximately 93 or 94 GB. mount point: '/home'
8: use gdisk to verify partition table & partitions
9: reboot to Kubuntu Live- this step may not be necessary, but I thought I would be
more comfortable doing this.
10: install Kubuntu, specifying mount points for all partitions on computer with
Windows 8.1 at '/dos/windows'
11: reboot into Kubuntu
12: install rEFInd
13: reboot.

Unknown: how to get the /boot/efi' directory populated with the Windows boot
information.

Does rEFInd do this automatically - I doubt it.

Alternatively I could copy the Windows information from the laptop to the
new '/boot/efi' directory. Would that work? I have doubts since the partition
numbers would differ from the laptop partitioning scheme and windows 8.1 on the
desktop is on a totally separate hdd, sdd, on the desktop. The laptop has everything
on the single hdd, sda. I assume the booting information specifies the location of the
OS to boot.

Alternatively, I could re-install Windows 8.1 from the DVD. This is not a big problem
since I only installed it almost 1 month ago exactly. I use Windows very, very little.
Mainly to use tax prep s/w and the rare s/w that I need that only runs on Windows
and boot it infrequently just to check for updates and update the anti-virus s/w.
So essentially it is a virgin installation.

Comments? Ideas? Thank you for any and all.

[geezer]

By the way on getting Kubuntu to boot quietly when rEFInd boots it. I had installed rEFInd initially under Windows 8.1. I re-installed rEFInd under Kubuntu on the laptop. Rebooted and Kubuntu Logo came up and the boot was a normal Kubuntu boot.

[Qqmike]

Good, thanks. Also, I'm pretty sure, there's a setting in the conf file for that (when installed in Kubuntu).

[Qqmike]

I don't know about the Windows question, maybe someone will know. If it were Kubuntu, you could do something like re-install GRUB2(EFI) from live DVD (or use rEFInd to boot into Kubuntu and work from there), and it would set itself up in the sda1=ESP. Does Windows have any such capability for UEFI?

Btw, Boot Repair does work for UEFI. And I thought it knew about GPT. It must, as it is being used all over the place to fix current booting problems. I'll have to check on this. I checked what I have here: A 32-bit Boot repair CD; and a 64-bit Boot Repair USB flash drive. So you need the 64-bit version of Boot Repair (I'm pretty sure that's the deal).

7: use Gparted to add 3 partitions on sda:
1) sda1, 350 MB, efi type partition, "EFI" partition label

In GParted live, you set the type of the ESP by setting the "boot" flag on it. That is not a boot flag as we think of boot flags, but it is GParted's way to specify the ESP. It may then show up in GParted as boot-esp or something like that.

Unknown: how to get the /boot/efi' directory populated with the Windows boot
information.

Does rEFInd do this automatically - I doubt it ... Alternatively, I could re-install Windows 8.1 from the DVD.

That's the Windows question I mentioned above. I also first thought about a copy, but doubtful that will work for the reasons you listed--it needs to be setup specific to this setup/installation. Of course, a re-install usually always freshens things up and sets things right and current. You or Windows must set up the whole directory and contents in the ESP: /boot/efi/EFI/Windows ... (as seen mounted in Kubuntu at /boot/efi). The question is, is there any way inside of your 8.1 to "re-install" the boot loader in UEFI mode to set itself up in your ESP now? As I said, I don't know Windows.

(I didn't see your post on this when I posted above.)

[Qqmike]

Oh, btw, I would set myself up with a UEFI version of Boot Repair ;-)

[Qqmike]

Yeah, regarding Boot Repair on UEFI+GPT,
http://sourceforge.net/p/boot-repair-cd/home/Home/

repairs recent (UEFI) computers as well as old PCs

http://sourceforge.net/projects/boot-repair-cd/files/

Most recent computers need the 64bit version. Others need the 32bit one.

[Qqmike]

Regarding rEFInd, configuring to see the OS boot, is this what you are referring to (copied from refind.conf):

# Launch specified OSes in graphics mode. By default, rEFInd switches
# to text mode and displays basic pre-launch information when launching
# all OSes except OS X. Using graphics mode can produce a more seamless
# transition, but displays no information, which can make matters
# difficult if you must debug a problem. Also, on at least one known
# computer, using graphics mode prevents a crash when using the Linux
# kernel's EFI stub loader. You can specify an empty list to boot all
# OSes in text mode.
# Valid options:
# osx - Mac OS X
# linux - A Linux kernel with EFI stub loader
# elilo - The ELILO boot loader
# grub - The GRUB (Legacy or 2) boot loader
# windows - Microsoft Windows
# Default value: osx
#
#use_graphics_for osx,linux

[SteveRiley]

The only thing that bothers me about UEFI is the fact that MicroSoft seems to have cornered the Secure keys and others have to go to them to get keys (is that the correct terminology?) and then abide by their restrictive conditions. How did MicroSoft get the only supply of keys and why cannot some other company/organization get keys and pass them out like MicroSoft does?

Microsoft is not the only supplier of keys.

To obtain the "Certified for Windows 8" logo, Microsoft required hardware OEMs to deliver machines with Secure Boot enabled and with a Microsoft-signed platform key (PK). So configured, only boot loaders and drivers signed with the Microsoft platform key would function. This creates a quandary for alternate operating systems with their own boot loaders and drivers: these need to be signed by the same PK to function.

There are alternatives, of course--

• Disable Secure Boot entirely. It's my choice.
• Operating system vendors could supply their own PKs that have no relationship to Microsoft's PK. But how would vendors get their PKs to customers? Remember, the PK is placed into the firmware during hardware manufacture. Hardware OEMs operate on razor thin margins; they'll never agree to the extra expense of managing multiple PKs for the 1% of all PC people who don't use Windows.
• A key-exchange key (KEK), related to Microsoft's PK, can be installed into the firmware that would then allow using boot loaders and drivers signed by alternate certificates. Fedora's Shim program (used by many Linux distros, including all the *buntus) works this way.
• Machine owner keys (MOKs) can be generated by users and stored in the firmware. You would sign your kernels and drivers with your MOK to get the system to boot. The MOK is not related to Microsoft's PK at all.

Rod Smith has all the details.

The Windows 8 logo requirements also required OEMs to provide a mechanism to disable Secure Boot. This will change in Windows 10; OEMs can now choose what to do. It's speculation at this point whether OEMs will remove the ability to disable Secure Boot.

I am going to have to find out how to have rEFInd boot Kubuntu quietly. Right now Kubuntu spits out a few screenfuls of messages that are probably helpful to someone who can read very, very fast and also understands the messages being displayed. I can do neither. So I get nervous when I get messages from the OS that I do not understand even though I can do nothing about them.

They are nothing more than status messages and I find them quite comfortable. Watching the scrolling boot text makes me feel that the computer is doing what it's supposed to be doing. I absolutely loathe "quiet" boots or graphical splashes, because they hide the boot process and keep me in the dark about what's going on. With time, you, too, can come to view the scrolling messages as a source of comfort

[Qqmike]

With time, you, too, can come to view the scrolling messages as a source of comfort.

Yes, or turn them off in refind.conf!

Back to your Windows question in Post #15,

Unknown: how to get the /boot/efi' directory populated with the Windows boot information. Does rEFInd do this automatically - I doubt it.

On a quick search, I did not find an answer to this yet, did you? Except yours: re-install.

[geezer]

Oh, btw, I would set myself up with a UEFI version of Boot Repair ;-)

Just checked the version I downloaded. It is the 64 bit version: file:///home/terry/Downloads/boot-repair-disk-64bit.iso

Probably reverted the gpt disk to msdos partition table when it repaired the mbr because there wasn't any ESP on the desktop sda, so it automatically set up for an mbr boot which would be a msdos partition table.

[geezer]

Okay, just read through Rod Smith's "Managing EFI Boot Loaders for Linux: EFI Boot Loader Installation" and in my interpretation the boot loaders do not seem to be dependent on the installation specifics. He states that the boot loader can be copied from another source (computer, directory, etc.) with the 'cp' command, then use 'efibootmgr' command to register the boot loader. The boot loaders are like GRUB.

However, like GRUB the boot loaders need a configuration file and that might be the sticking point since I'm not too sure that the windows boot loaders have anything like "update-grub". I have found directions using the windows installation disk to 'rebuild' the BCD which is probably/hopefully the same as 'update-grub'. However, to get to that point the installation disk is supposed to offer a "repair your computer" and I don't think mine does.

I'll find out after I go through the above process and install Kubuntu. Then I either install windows 8.1 or try the 'rebuilkd bcd' option if it is available then. It might then since windows 8.1 is already installed on a gpt disk and an ESP will reside on another disk. So maybe those conditions might prompt a 'repair' option. That would save a looooooooooooooooooooooong time and several reboots for the windows 8.1 install. Also, I'm not too sure how well the windows installation would handle boot order with the windows being installed on sdd and ESP and Kubuntu on sda.

[xennex81]

Okay then, just for kicks. Third attempt as my mobile browser keeps deleting my text. Don't you love that software? Google Chrome for android. Keeps resetting the page I was writing on as I "alt-tab" out. Marvellous software, so dependable. Makes me feel my time is worth so much (actually it does).

(So I'm imprisoned in another psych institution as I await my surgery).

Just for kicks: what are the three simple steps needed to turn my Debian server into UEFI?

Details:

* 2 hdd in RAID
* each drive has 2MB "Bios Boot Partition" in GPT
* next to that is 500 mb boot partition for grub files in raid 1 (mirror).
* system can boot from either hard disk
* just reads sda1/sdb1 and then proceeds to boot also if there is only a single hdd connected.
* root fs is also in mirror rest is stripe or mirror.

What would be needed to turn this into UEFI? I bet it requires a special partition. Grub is currently installed in sda1/sdb1 but its files are in sda2/sdb2. Say I don't even want a boot loader.. is that possible? (Bios does the loading)?.

[geezer]

Microsoft is not the only supplier of keys.

To obtain the "Certified for Windows 8" logo, Microsoft required hardware OEMs to deliver machines with Secure Boot enabled and with a Microsoft-signed platform key (PK). So configured, only boot loaders and drivers signed with the Microsoft platform key would function. This creates a quandary for alternate operating systems with their own boot loaders and drivers: these need to be signed by the same PK to function.

There are alternatives, of course--

• Disable Secure Boot entirely. It's my choice.
• Operating system vendors could supply their own PKs that have no relationship to Microsoft's PK. But how would vendors get their PKs to customers? Remember, the PK is placed into the firmware during hardware manufacture. Hardware OEMs operate on razor thin margins; they'll never agree to the extra expense of managing multiple PKs for the 1% of all PC people who don't use Windows.
• A key-exchange key (KEK), related to Microsoft's PK, can be installed into the firmware that would then allow using boot loaders and drivers signed by alternate certificates. Fedora's Shim program (used by many Linux distros, including all the *buntus) works this way.
• Machine owner keys (MOKs) can be generated by users and stored in the firmware. You would sign your kernels and drivers with your MOK to get the system to boot. The MOK is not related to Microsoft's PK at all.

Rod Smith has all the details.

The Windows 8 logo requirements also required OEMs to provide a mechanism to disable Secure Boot. This will change in Windows 10; OEMs can now choose what to do. It's speculation at this point whether OEMs will remove the ability to disable Secure Boot.

This is interesting. I just looked over both the desktop and the laptop. Both are brand new with the desktop being the oldest, 6-4-2015 for the desktop and 6-24-2015 for the laptop. Neither computer has a Windows logo sticker on it anywhere. The laptop has the Intel sticker on it. Don't know what that means if anything.

They are nothing more than status messages and I find them quite comfortable. Watching the scrolling boot text makes me feel that the computer is doing what it's supposed to be doing. I absolutely loathe "quiet" boots or graphical splashes, because they hide the boot process and keep me in the dark about what's going on. With time, you, too, can come to view the scrolling messages as a source of comfort

I used to watch them years back when that was the standard booting process- no splash screen. I got to the point I was comfortable with them, but never took the time to learn anything about them. Rarely I would see a message that wasn't normal, but the screen flowed by so fast that I couldn't understand what the meaning was. And then if a failure message popped up and was normal (some h/w that was looked for but wasn't there) I was getting to the point that failure messages didn't bother me, they're "normal", except not always, but the screen goes by so fast that since I no longer was really paying attention and so couldn't decide was that a "normal" failure message or something new??

So I like the splash screen much better now. If something drastic fails, I'll find out about it anyway and can hopefully find a remedy. If I cannot, then the failure message probably wouldn't have done me much good anyway.

[Qqmike]

Also, I'm not too sure how well the windows installation would handle boot order with the windows being installed on sdd and ESP and Kubuntu on sda.

In theory, it shouldn't matter, correct? Just use efibootmgr to re-order the boot options in firmware to suit you. Usually, if GRUB is installed last, it takes over and places itself first in boot order. We'll see, huh?

He states that the boot loader can be copied from another source (computer, directory, etc.) with the 'cp' command, then use 'efibootmgr' command to register the boot loader.

That's my impression, too. Two notes on that, fwiw:

(1) Even though a boot option is not "officially" registered (using that complex-syntax efibootmgr command) with your PCs firmware, rEFInd will usually find it on its own and offer it up to you as a boot option in its boot menu. I've done this many times. For example, I've created such things as the directory /boot/efi/EFI/grub/grub_for_15.04_sdb2 using the general form of the GRUB 2-EFI grub-install command (explained in my how-to). rEFInd finds it and lists it as "grub_for_15.04_sdb2" in its boot menu.

(2) Let's say you do put together your own directory under /EFI/ubuntu or /EFI/my_own_manual_bootloader_installation. And you register it with your PCs firmware using efibootmgr command, as Rod Smith explains. What, then, about updates to your boot loader: will they go "there" to the custom directory you made? I tend to doubt it. What about changes to you system setup, you must then manually update your boot loader's boot configuration file. IOW, I am always concerned about having to maintain these custom boot loader setups, here, and in the past GRUB2 and GRUB Legacy custom setups. I'm getting too old to monitor such things ... and should have better things to do with remaining time on planet Earth ... But that's just a personal thing, not really relevant here.