Duplicating EFI functionality is a waste of time
Duplicating EFI functionality is a waste of time
Posted Jul 8, 2012 1:51 UTC (Sun) by zlynx (guest, #2285)In reply to: 'You have to divulge your private key' meme by mjg59
Parent article: The FSF's advice to distributors on UEFI secure boot
Booting off FAT is a EFI requirement. Just put your boot kernel there on the boot partition and it works.
System lockdown is done in EFI with password, default boot option and 0 timeout or a startup.nsh script.
Other operating systems are supported by EFI unless it is a BIOS only operating system then a BIOS emulation layer is required to boot first, like Apple Bootcamp does for Windows XP.
You would not want another UI in a EFI bootloader because the EFI is supposed to have all of the UI already.
Summary: We do not need to duplicate everything EFI already does in a EFI boot loader.
Posted Jul 8, 2012 2:00 UTC (Sun)
by mjg59 (subscriber, #23239)
[Link] (3 responses)
The firmware retrieves efilinux. How does efilinux download the kernel?
"Booting off FAT is a EFI requirement. Just put your boot kernel there on the boot partition and it works."
And now your /boot is FAT and you can't make symlinks in it, resulting in various existing tools now being broken.
"System lockdown is done in EFI with password, default boot option and 0 timeout or a startup.nsh script."
All well and good until you want to modify a kernel parameter and now have to wade through a configuration menu that differs between hardware vendors.
"Other operating systems are supported by EFI unless it is a BIOS only operating system then a BIOS emulation layer is required to boot first, like Apple Bootcamp does for Windows XP."
efilinux doesn't support chaining to other operating systems, so if your shim loader boots it first then you're stuck only booting Linux. Except for:
"You would not want another UI in a EFI bootloader because the EFI is supposed to have all of the UI already."
Have you actually used an EFI system? The UI is completely inconsistent between vendors, is often slow and awkward and may not let you edit command line options. Having half your technical documentation say "Refer to your system vendor documentation in order to determine if and how you can edit kernel options" is dreadful. Doing this in the bootloader means that you can guarantee consistency.
Posted Jul 10, 2012 3:09 UTC (Tue)
by raven667 (subscriber, #5198)
[Link] (2 responses)
Posted Jul 10, 2012 3:12 UTC (Tue)
by mjg59 (subscriber, #23239)
[Link] (1 responses)
Posted Jul 10, 2012 4:21 UTC (Tue)
by raven667 (subscriber, #5198)
[Link]
Duplicating EFI functionality is a waste of time
Duplicating EFI functionality is a waste of time
Duplicating EFI functionality is a waste of time
Duplicating EFI functionality is a waste of time