[SOLVED] Booting a luks encrypted system directly from UEFI firmware

bananabrain · 2015-06-17 13:58:23

I've been struggling somewhat with my first UEFI machine (a Toshiba laptop).

The wiki got me to a basic four-partition install okay, and then after a small amount of pain I managed to get a build booted okay from gummiboot and with with root, swap and home luks-encrypted.

What I'm trying to do now is boot directly from the UEFI using an appropriate firmware entry, ie with something like what's described in the EFISTUB Wiki page:

# efibootmgr -d /dev/sdX -p Y -c -L "Arch Linux" -l /vmlinuz-linux -u "root=/dev/sda2 rw initrd=/initramfs-linux.img"

...but I've been unable to achieve this with luks-encrypted partitions. Has anyone here had any success? Is there a "-u" parameter in the above command that will achieve this? I've certainly not found anything online explaining how this can be done, so maybe I'm being unrealistic and expecting too much.

Last edited by bananabrain (2015-06-18 14:45:56)

Head_on_a_Stick · 2015-06-17 20:01:22

Try this (untested -- I don't use encryption):

# efibootmgr -d /dev/sdX -p Y -c -L "Arch Linux" -l /vmlinuz-linux -u "cryptdevice=UUID=<UUID>:<mapped-name> root=UUID=<luks-UUID> rw initrd=/initramfs-linux.img"

bananabrain · 2015-06-17 22:38:34

Head_on_a_Stick wrote:

Try this (untested -- I don't use encryption):

# efibootmgr -d /dev/sdX -p Y -c -L "Arch Linux" -l /vmlinuz-linux -u "cryptdevice=UUID=<UUID>:<mapped-name> root=UUID=<luks-UUID> rw initrd=/initramfs-linux.img"

You're a star - that works perfectly.
I wondered about lifting that syntax from "$esp/loader/entries/arch-encrypted.conf" in my last instalation but stupidly thought it was gummiboot-specific.

I'm as surprised that I couldn't find your solution on the web as I am that so few people seem interested in using UEFI firmware in this way. It seems like PC hardware has at last "grown up", with a versatile firmware that must have been a long time in collaborative development - something akin to Sun's OpenBoot - but the community's response has been to create another raft of boot loaders to sit on top of it. Maybe I'm missing something.

Thanks very much for your help.

Head_on_a_Stick · 2015-06-18 06:34:40

You're welcome

Please add "[SOLVED]" to the thread title for the benefit of others.

Arch Linux

#1 2015-06-17 13:58:23

[SOLVED] Booting a luks encrypted system directly from UEFI firmware

#2 2015-06-17 20:01:22

Re: [SOLVED] Booting a luks encrypted system directly from UEFI firmware

#3 2015-06-17 22:38:34

Re: [SOLVED] Booting a luks encrypted system directly from UEFI firmware

#4 2015-06-18 06:34:40

Re: [SOLVED] Booting a luks encrypted system directly from UEFI firmware

Board footer