Acquire signed PreLoader.efi
and HashTool.efi
and copy them to the boot loader
directory; for systemd-boot use:
# cp {PreLoader,HashTool}.efi esp/EFI/systemd
Now copy over the boot loader binary and rename it to loader.efi
;
for systemd-boot use:
# cp esp/EFI/systemd/systemd-bootx64.efi esp/EFI/systemd/loader.efi
Finally, create a new NVRAM entry to boot PreLoader.efi
:
# efibootmgr --disk /dev/sdX --part Y --create --label "PreLoader" --loader /EFI/systemd/PreLoader.efi
Replace X
with the drive letter and replace Y
with the partition number of the EFI System Partition.
This entry should be added to the list as the first to boot;
check with the efibootmgr
command and adjust the
boot-order if necessary.
If there are problems booting the custom NVRAM entry, copy HashTool.efi
& loader.efi
to the default loader location
booted automatically by UEFI systems:
# cp HashTool.efi esp/EFI/Boot # cp esp/EFI/systemd/systemd-bootx64.efi esp/EFI/Boot/loader.efi
Copy over PreLoader.efi
and rename it:
# cp PreLoader.efi esp/EFI/Boot/bootx64.efi
For particularly intransigent UEFI implementations, copy PreLoader.efi
to the default loader location used by Windows systems:
# mkdir -p esp/EFI/Microsoft/Boot # cp PreLoader.efi esp/EFI/Microsoft/Boot/bootmgfw.efi
As before, copy HashTool.efi
& loader.efi
to esp/EFI/Microsoft/Boot
When the system starts with Secure Boot enabled, follow the steps
above to enrol loader.efi
and /vmlinuz-linux
(or whichever kernel image is being used).