Difference between revisions of "REFInd"

From ArchWiki
Jump to: navigation, search
(GPT fdisk (gdisk): reduce duplication with gdisk#gdisk EFI application)
 
(353 intermediate revisions by 34 users not shown)
Line 1: Line 1:
 +
{{Lowercase title}}
 
[[Category:Boot loaders]]
 
[[Category:Boot loaders]]
[[zh-CN:REFInd]]
+
[[ja:REFInd]]
{{Lowercase title}}
+
[[ru:REFInd]]
rEFInd is a fork of rEFIt Boot Manager (used in Intel Macs) by Rod Smith (author of gdisk). rEFInd fixes many issues in rEFIt with respect to non-Mac UEFI booting and also has support for booting [[EFISTUB]] kernels and contains some features specific to them.
+
[[zh-hans:REFInd]]
 +
{{Related articles start}}
 +
{{Related|Arch boot process}}
 +
{{Related|Boot loader}}
 +
{{Related|Unified Extensible Firmware Interface}}
 +
{{Related|EFISTUB}}
 +
{{Related articles end}}
 +
[https://www.rodsbooks.com/refind/ rEFInd] is a [[UEFI]] [[boot manager]] capable of launching [[EFISTUB]] kernels. It is a fork of the no-longer-maintained rEFIt and fixes many issues with respect to non-Mac UEFI booting. It is designed to be platform-neutral and to simplify booting multiple OSes.
 +
 
 +
{{Note|In the entire article {{ic|''esp''}} denotes the mountpoint of the [[EFI system partition]] aka ESP.}}
 +
 
 +
== Installation ==
 +
 
 +
[[Install]] the {{pkg|refind-efi}} package.
 +
 
 +
rEFInd has '''read-only''' drivers for ReiserFS, Ext2, Ext4, Btrfs, ISO-9660, HFS+, and NTFS. Additionally rEFInd can use drivers from the UEFI firmware i.e. FAT (and HFS+ on Macs or ISO-9660 on some systems).
 +
 
 +
{{Note|Your kernel and initramfs must reside on a file system that rEFInd can read.}}
 +
 
 +
To find additional drivers see [https://www.rodsbooks.com/refind/drivers.html#finding The rEFInd Boot Manager: Using EFI Drivers: Finding Additional EFI Drivers].
 +
 
 +
=== Installation with refind-install script ===
 +
 
 +
The rEFInd package includes the ''refind-install'' script to simplify the process of setting rEFInd as your default EFI boot entry. The script has several options for handling differing setups and UEFI implementations. See {{man|8|refind-install}} or read the comments in the install script for explanations of the various installation options.
 +
 
 +
For many systems it should be sufficient to simply run:
 +
 
 +
# refind-install
 +
 
 +
This will attempt to find and mount your [[ESP]], copy rEFInd files to {{ic|''esp''/EFI/refind/}}, and use [[efibootmgr]] to make rEFInd the default EFI boot application.
 +
 
 +
Alternatively you can install rEFInd to the default/fallback boot path {{ic|''esp''/EFI/BOOT/bootx64.efi}}. This is helpful for bootable USB flash drives or on systems that have issues with the NVRAM changes made by ''efibootmgr'':
 +
 
 +
# refind-install --usedefault ''/dev/sdXY''
 +
 
 +
Where {{ic|''/dev/sdXY''}} is of your EFI System Partition.
 +
 
 +
{{Note|By default {{ic|refind-install}} installs only the driver for the file system on which kernel resides. Additional file systems need to be installed manually or you can install all drivers with the {{ic|--alldrivers}} option. This is useful for bootable USB flash drives e.g.:
 +
 
 +
# refind-install --usedefault ''/dev/sdXY'' --alldrivers
 +
 
 +
}}
 +
 
 +
After installing rEFInd's files to the ESP, verify that rEFInd has created {{ic|refind_linux.conf}} containing the required [[kernel parameters]] (e.g. {{ic|1=root=}}) in the same directory as your kernel. If it has not created this file, you will need to set up [[#Passing kernel parameters]] manually or you will most likely get a kernel panic on your next boot.
 +
 
 +
By default, rEFInd will scan all of your drives (that it has drivers for) and add a boot entry for each EFI bootloader it finds, which should include your kernel (since Arch enables [[EFISTUB]] by default). So you may have a bootable system at this point.
 +
 
 +
{{Tip|It is always a good idea to edit the default configuration file {{ic|''esp''/EFI/refind/refind.conf}} to ensure that the default options work for you.}}
 +
 
 +
{{Warning|When {{ic|refind-install}} is run in chroot (e.g. in live system when installing Arch Linux) {{ic|/boot/refind_linux.conf}} is populated with kernel options from the live system not the one on which it is installed. You will need to edit {{ic|/boot/refind_linux.conf}} and adjust the kernel options manually. See [[#refind_linux.conf]] for an example.}}
 +
 
 +
==== Secure Boot ====
 +
 
 +
See [https://www.rodsbooks.com/refind/secureboot.html Managing Secure Boot] for [[Secure Boot]] support in rEFInd.
 +
 
 +
===== Using PreLoader =====
 +
 
 +
See [[Secure Boot#Set up PreLoader]] to acquire signed {{ic|PreLoader.efi}} and {{ic|HashTool.efi}} binaries.
 +
 
 +
Execute {{ic|refind-install}} with the option {{ic|--preloader ''/path/to/preloader''}}
 +
 
 +
# refind-install --preloader /usr/share/preloader-signed/PreLoader.efi
 +
 
 +
Next time you boot with Secure Boot enabled, HashTool will launch and you will need to enroll the hash of rEFInd ({{ic|loader.efi}}), rEFInd's drivers (e.g. {{ic|ext4_x64.efi}}) and kernel (e.g. {{ic|vmlinuz-linux}}).
 +
 
 +
See {{man|8|refind-install}} for more information.
 +
 
 +
{{Tip|The signed ''HashTool'' is only capable of accessing the partition it was launched from. This means if your kernel is not on the ESP, you will not be able to enroll its hash from ''HashTool''. You can workaround this by using [[#KeyTool]], since it is capable of enrolling a hash in MokList and is not limited to one partition. Remember to enroll ''KeyTool'''s hash before using it.}}
 +
 
 +
===== Using shim =====
 +
 
 +
[[Install]] {{AUR|shim-signed}}. Read [[Secure Boot#shim]], but skip all file copying.
 +
 
 +
====== Using hashes ======
 +
To use only hashes with ''shim'', execute {{ic|refind-install}} with the option {{ic|--shim ''/path/to/shim''}}
 +
 
 +
# refind-install --shim /usr/share/shim-signed/shimx64.efi
 +
 
 +
Next time you boot with Secure Boot enabled, MokManager will launch and you will need to enroll the hash of rEFInd ({{ic|grubx64.efi}}), rEFInd's drivers (e.g. {{ic|ext4_x64.efi}}) and kernel (e.g. {{ic|vmlinuz-linux}}).
 +
 
 +
====== Using Machine Owner Key======
 +
 
 +
To sign rEFInd with a Machine Owner Key (MOK), install {{Pkg|sbsigntools}}.
  
== Planning the partitions and kernel location ==
+
{{Tip|If you already have [[Secure Boot#shim with key|created a MOK]], place the files in the directory {{ic|/etc/refind.d/keys}} with the names {{ic|refind_local.key}} (PEM format private key), {{ic|refind_local.crt}} (PEM format certificate) and {{ic|refind_local.cer}} (DER format certificate).}}
  
rEFInd is a UEFI boot manager that was written to handle EFI boot, and make booting Windows, Linux and Mac OS a relatively pain free process, particularly as the linux kernel is now built with its own EFI stub boot loader.
+
Execute {{ic|refind-install}} with the options {{ic|--shim ''/path/to/shim''}} and {{ic|--localkeys}}:
  
It is convenient to set up the arch linux system so that the kernel and initial ramdisk files are in a journalled filesystem, so that repairs are possible in the event of errors in the
+
# refind-install --shim /usr/share/shim-signed/shimx64.efi --localkeys
filesystem, and keep only a minimal set of necessary files on the EFI, which is required to be formatted as VFAT.  
 
  
It is also desirable to have the system rebootable immediately after a kernel update, without further preparation or moving the kernel files from the location that they are created by pacman.
+
''refind-install'' will create the keys for you and sign itself and its drivers. You will need to sign the kernel with the same key, e.g.:
 
The assumption here is that the EFI will be mounted after the install as /boot/efi
 
  
If the root partition is mounted as / and a directory called /boot is created, then a convenient way to mount the EFI partition is to mount it as /boot/efi. Then the normal install location for the kernel and initial ramdisk is in /boot/ and the (VFAT) EFI is mounted at /boot/efi/. Then the rEFInd binary and associated directories and files can be placed in a newly created directory at /boot/efi/EFI/refind/
+
# sbsign --key /etc/refind.d/keys/refind_local.key --cert /etc/refind.d/keys/refind_local.crt --output /boot/vmlinuz-linux /boot/vmlinuz-linux
  
== Boot EFISTUB using rEFInd ==
+
{{Tip|The kernel signing can be automated with a [[pacman hook]], e.g.:
{{Tip|If you're new to [[EFISTUB]] and/or rEFInd, you need to read [http://www.rodsbooks.com/refind/linux.html The rEFInd Boot Manager: Methods of Booting Linux] before going any further. This section illustrates only one possible use-case for a pure Arch linux system which is not suitable for all configurations, and includes a section with one use-case for dual booting Archlinux with Windows 8.1.}}
 
  
{{Note|{{pkg|refind-efi}} includes a install script from upstream at {{ic|/usr/bin/refind-install}} which does the job of setting-up of rEFInd similar to the steps below.}}
+
{{hc|/etc/pacman.d/hooks/999-sign_kernel_for_secureboot.hook|2=
 +
[Trigger]
 +
Operation = Install
 +
Operation = Upgrade
 +
Type = Package
 +
Target = linux
  
{{Note|For 32-bit aka IA32 EFI, replace '''x64''' with '''ia32''' (case-sensitive) in the commands below.}}
+
[Action]
 +
Description = Signing kernel with Machine Owner Key for Secure Boot
 +
When = PostTransaction
 +
Exec = /usr/bin/sbsign --key /etc/refind.d/keys/refind_local.key --cert /etc/refind.d/keys/refind_local.crt --output /boot/vmlinuz-linux /boot/vmlinuz-linux
 +
Depends = sbsigntools
 +
}}
 +
}}
  
* Mount efivarfs
+
Once in MokManager add {{ic|refind_local.cer}} to MoKList. {{ic|refind_local.cer}} can be found inside a directory called {{ic|keys}} in the rEFInd's installation directory, e.g. {{ic|''esp''/EFI/refind/keys/refind_local.cer}}.
  
# mount -t efivarfs efivarfs /sys/firmware/efi/efivars              # ignore if already mounted
+
See {{man|8|refind-install}} for more information.
  
* Install the {{Pkg|refind-efi}} package.
+
===== Using your own keys =====
  
* Copy the following files from their source directory to their destination
+
Follow [[Secure Boot#Using your own keys]] to create keys.
  
# cp /usr/share/refind/refind_x64.efi /boot/efi/EFI/refind/refind_x64.efi
+
Create directory {{ic|/etc/refind.d/keys}} and place Signature Database ('''db''') key and certificates in it. Name the files: {{ic|refind_local.key}} (PEM format private key), {{ic|refind_local.crt}} (PEM format certificate) and {{ic|refind_local.cer}} (DER format certificate).
# cp /usr/share/refind/refind.conf-sample  /boot/efi/EFI/refind/refind.conf
 
# cp -r /usr/share/refind/icons /boot/efi/EFI/refind/
 
# cp -r /usr/share/refind/fonts /boot/efi/EFI/refind/
 
# cp -r /usr/share/refind/drivers_x64 /boot/efi/EFI/refind/
 
  
* Edit rEFInd's config file at {{ic|/boot/efi/EFI/refind/refind.conf}}. The file is well commented and self explanatory. rEFInd should automatically find kernel files in /boot, but it is also possible to add a menu entry for Arch Linux. Set the default boot item to the Archlinux kernel by adding the line:
+
When running install script add option {{ic|--localkeys}}, e.g.:
  
  default_selection vmlinuz
+
  # refind-install --localkeys
  
A menu entry can be added to refind.conf such as
+
rEFInd EFI binaries will be signed with the supplied key and certificate.
  
{{hc|refind.conf|<nowiki>
+
=== Manual installation ===
menuentry "Arch Linux" {
 
        icon    EFI/refind/icons/os_linux.icns
 
        volume  "/"
 
        loader  /boot/vmlinuz-linux
 
        initrd  /boot/initramfs-linux.img
 
        options  "root=PARTUUID=3518bb68-d01e-45c9-b973-0b5d918aae96 rw rootfstype=ext4"
 
}
 
</nowiki>}}
 
  
but this may not be necessary unless standard options need to be changed. Note that the "volume" line contains the label of the volume where the root partition is. For alphameric characters only it is not necessary to put the name in quotes, but if you use special characters then the kernel will not boot unless the name is in quotes. Also the partition can be referenced using the PARTUUID or the UUID provided the appropriate string is used as verified from the output of the blkid command. If the root partition is not ext4 then the rootfstype will be as needed for the partition type, but should be detected automatically without this parameter.
+
{{Tip|rEFInd can boot Linux in many ways. See [https://www.rodsbooks.com/refind/linux.html The rEFInd Boot Manager: Methods of Booting Linux] for coverage of the various approaches.}}
  
Note that if you choose to mount your ESP as a different name to /boot/efi then replace these paths as appropriate as in the lines above.
+
If the {{ic|refind-install}} script does not work for you, rEFInd can be set up manually.
  
{{Note|Modify the loader and initrd paths if you did not place them in your ESP's root. Replace the string after PARTUUID with your root's PARTUUID. Please note in the example above that PARTUUID/PARTLABEL identifies a GPT partition, and differs from the UUID/LABEL, which identifies a filesystem. Using the PARTUUID/PARTLABEL is advantageous because it is invariant if you reformat the partition with another filesystem. It's also useful if you don't have a filesystem on the partition (or use LUKS, which doesn't support LABELs).}}
+
First, copy the executable to the ESP:
  
To find the PARTUUID (or UUID) for the root partition use:
+
# mkdir -p ''esp''/EFI/refind
 +
# cp /usr/share/refind/refind_x64.efi ''esp''/EFI/refind/
  
# blkid
+
If you want to install rEFInd to the default/fallback boot path replace {{ic|''esp''/EFI/refind/}} with {{ic|''esp''/EFI/BOOT/}} in the following instructions and copy rEFInd EFI executable to {{ic|''esp''/EFI/BOOT/bootx64.efi}}:
  
and
+
# mkdir -p ''esp''/EFI/BOOT
 +
# cp /usr/share/refind/refind_x64.efi ''esp''/EFI/BOOT/bootx64.efi
  
# lsblk -f
+
Then use [[efibootmgr]] to create a boot entry in the UEFI NVRAM, where {{ic|''/dev/sdX''}} and {{ic|''Y''}} are the device and partition number of your EFI System Partition. If you are installing rEFInd to the default/fallback boot path {{ic|''esp''/EFI/BOOT/bootx64.efi}}, you can skip this step.
  
to get the partition information matched to the correct root partition.
+
# efibootmgr --create --disk ''/dev/sdX'' --part ''Y'' --loader /EFI/refind/refind_x64.efi --label "rEFInd Boot Manager" --verbose
  
* If the kernel and initramfs are located at /boot as default, you can create a {{ic|refind_linux.conf}} file inside the directory where the kernel and initramfs files are located. Or you can copy the sample file to the same directory that the kernel and initramfs are located using:
+
At this point, you should be able to reboot into rEFInd, but it will not be able to boot your kernel. If your kernel does not reside on your ESP, rEFInd can mount your partitions to find it - provided it has the right drivers.
  
# cp /usr/share/refind/refind_linux.conf-sample /boot/refind_linux.conf
+
rEFInd automatically loads all drivers from the subdirectories {{ic|drivers}} and {{ic|drivers_''arch''}} (e.g. {{ic|drivers_x64}}) in its install directory.
  
{{hc|refind_linux.conf|<nowiki>
+
# mkdir ''esp''/EFI/refind/drivers_x64
"Boot with defaults"    "root=PARTUUID=XXXXXXXX rootfstype=XXXX ro"
+
# cp /usr/share/refind/drivers_x64/'''drivername'''_x64.efi ''esp''/EFI/refind/drivers_x64/
"Boot to terminal"      "root=PARTUUID=XXXXXXXX rootfstype=XXXX ro systemd.unit=multi-user.target"</nowiki>}}
 
  
where the PARTUUID from the blkid command is used, and the rootfstype is commonly ext4.
+
Now rEFInd should have a boot entry for your kernel, but it will not pass the correct kernel parameters. Set up [[#Passing kernel parameters]]. You should now be able to boot your kernel using rEFInd. If you are still unable to boot or if you want to tweak rEFInd's settings, many options can be changed with a configuration file:
  
This file tells rEFInd where the root partition is located for the system boot, so the PARTUUID is that for the root partition.
+
# cp /usr/share/refind/refind.conf-sample ''esp''/EFI/refind/refind.conf
  
The drivers that were copied to the refind directory in the ESP include an ext4 driver, and allow the rEFInd binary to read the kernel and initramfs file in the ext4 /boot directory.
+
The sample configuration file is well commented and self-explanatory.
  
{{Tip|Each line of {{ic|refind_linux.conf}} is displayed as a submenu by rEFInd. Access the submenu with "+" or "insert" or "F2" keys.}}
+
Unless you have set {{ic|textonly}} in the configuration file, you should copy rEFInd's icons to get rid of the ugly placeholders:
  
* Create a boot entry in the UEFI NVRAM in the motherboard using efibootmgr
+
# cp -r /usr/share/refind/icons ''esp''/EFI/refind/
  
# efibootmgr -c -d /dev/sdX -p Y -l /EFI/refind/refind_x64.efi -L "rEFInd"
+
You can try out different fonts by copying them and changing the {{ic|font}} setting in {{ic|refind.conf}}:
  
where sdX is drive containing the EFI partition, and Y is the partition number for the EFI on that drive.
+
# cp -r /usr/share/refind/fonts ''esp''/EFI/refind/
  
The entries can be checked by just using the command
+
{{Tip|Pressing {{ic|F10}} in rEFInd will save a screenshot to the top level directory of the ESP.}}
  
# efibootmgr
+
=== Upgrading ===
  
on its own to verify that there is now a refind entry, and the boot order should show that this is the first entry in the list.
+
Pacman updates the rEFInd files in {{ic|/usr/share/refind/}} and will not copy new files to the ESP for you. If {{ic|refind-install}} worked for your original installation of rEFInd, you can rerun it to copy the updated files. The new configuration file will be copied as {{ic|refind.conf-sample}} so that you can integrate changes into your existing configuration file using a diff tool. If your rEFInd required [[#Manual installation]], you will need to figure out which files to copy yourself.
  
For a few system types if the efibootmgr command does not create NVRAM entries correctly, then an alternative is to use bcfg from within a UEFI shell version 2, to write and manage NVRAM entries. Information about this is available elsewhere in the wiki.
+
==== Pacman hook ====
  
{{Note|As of {{Pkg|refind-efi}} 0.2.7, refind can auto-detect kernels in {{ic|/boot}}, if there are UEFI drivers for the filesystem used by /boot partition (or / partition if no separate /boot is used) in the ESP, and are loaded by rEFInd. This is enabled in the default configuration in {{ic|refind.conf}} (you may need to include the PATH to the drivers folders in the ESP). See [http://www.rodsbooks.com/refind/drivers.html] for more info.}}
+
You can automate the update process using a [[pacman hook]]:
  
Once the system is rebooted when the install is complete the system should then boot to the graphical rEFInd screen after the POST is complete, and by default a 20 second timeout
+
{{hc|/etc/pacman.d/hooks/refind.hook|2=[Trigger]
will run after which the system should boot by default to Archlinux (The timeout period can be changed by editing refind.conf). Once the system has booted then the root user can login and continue to configure the newly installed system.
+
Operation=Upgrade
 +
Type=Package
 +
Target=refind-efi
  
During the 20 second timeout period the rEFInd boot manager can be interrupted to select different icons that can be booted, and it is also possible to change the boot kernel parameters
+
[Action]
in a similar way to what many users have been familiar with in the past using grub.
+
Description = Updating rEFInd on ESP
 +
When=PostTransaction
 +
Exec=/usr/bin/refind-install
 +
}}
  
It is also possible to get a screenshot of the graphical rEFInd screen by hitting F10 and a bmp image file will be written to the top level directory of the EFI.
+
Where the {{ic|1=Exec=}} may need to be changed to the correct update command for your setup. If you did [[#Manual installation]], you could create your own update script to call with the hook.
  
When the Archlinux kernel is updated via pacman then no further action is needed other than to reboot if the setup described above is used. For customised setups where the kernel is not placed in the /boot directory then the kernel and initramfs files may need to be moved to the directory where they will be booted before the new kernel will be active after reboot.
+
{{Tip|If you setup rEFInd with [[#Secure Boot]], you may want to additionally add the option {{ic|--yes}} to the {{ic|refind-install}} command. It will prevent the command from failing if it gets executed when Secure Boot is disabled. See {{man|8|refind-install}} for more information.}}
  
== A dual boot setup for Archlinux and Windows 8.1 using rEFInd ==
+
== Configuration ==
  
A second use-case is where an arch install is to be added to a pre-existing Windows 8.1 setup as a dual boot system, where booting to both operating systems is desired as well as any factory Recovery partitions.
+
The rEFInd configuration {{ic|refind.conf}} is located in the same directory as the rEFInd EFI application (usually {{ic|''esp''/EFI/refind}} or {{ic|''esp''/EFI/BOOT}}). The default configuration file contains extensive comments explaining all its options, see [https://www.rodsbooks.com/refind/configfile.html Configuring the Boot Manager] for more detailed explanations.
  
Here only the differences between the pure Archlinux setup above and the dual boot system are highlighted.
+
=== Passing kernel parameters ===
  
Normally Windows 8 or 8.1 boots under Secure Boot. Although in principle Secure Boot could be setup for Archlinux it is not straighforward, and it is recommended to switch off Secure Boot in the BIOS if the machine is to be dual booted with Archlinux. Check that the machine still boots correctly with Secure Boot turned off.
+
There are two methods for setting the [[kernel parameters]] that rEFInd will pass to the kernel.
  
It is also necessary to switch off Fastboot from within Windows 8.1 before attempting to install Archlinux in a dual boot system.  Fastboot is a type of hybrid suspend with part of the
+
==== For kernels automatically detected by rEFInd ====
system stored during shutdown.  If Fastboot is not turned off then corruption is likely if Windows is booted again after the system has booted Archlinux.
 
  
The changes that are therefore recommended for a pre-existing Windows 8 or 8.1 system on which Archlinux is going to be installed are as follows:
+
For automatically detected kernels you can either specify the kernel parameters explicitly in {{ic|/boot/refind_linux.conf}} or rely on rEFInd's ability to identify the root partition and kernel parameters. See [https://www.rodsbooks.com/refind/linux.html#easiest Methods of Booting Linux: For Those With Foresight or Luck: The Easiest Method] for more information.
  
1) Within Windows 8.1 switch off Fastboot and check that Windows restarts without any problem.
+
{{Tip|rEFInd will automatically choose the Arch Linux icon ({{ic|os_arch.png}}) for the boot entry when {{ic|/etc/os-release}} is on the same partition as the kernel. If your {{ic|/boot}} is a separate partition see [https://www.rodsbooks.com/refind/configfile.html#icons Configuring the Boot Manager: Setting OS Icons].}}
2) Switch off Secure Boot from the BIOS settings, and check that Windows restarts correctly.
 
  
In order to create space on the disk for linux partitions it is recommended that, with Windows 8.1 running, go to the Windows Disk Management facility and shrink the C: drive to make
+
For rEFInd to properly match multiple kernels with their respective initramfs you must uncomment and edit {{ic|extra_kernel_version_strings}} option in {{ic|refind.conf}}. E.g.:
space for new partitions in which Archlinux will be installed.
 
  
Note here that if you change the partitions using an externally booted partition editor such as gparted it is possible that Windows, or any Recovery boot partitions may not boot once the partitions, or particularly the partition numbers, have been changed.  
+
{{hc|''esp''/EFI/refind/refind.conf|
 +
...
 +
extra_kernel_version_strings linux-hardened,linux-zen,linux-lts,linux
 +
...
 +
}}
  
It is straightforward to create new partitions using the Archlinux install iso during the install process using the gdisk command.
+
{{Note|rEFInd only supports detecting one initramfs image per kernel, meaning it will not detect fallback initramfs nor [[microcode]] images.}}
  
It is recommended not to create additional EFI partitions, and to utilise the existing EFI partition that the pre-existing Windows system uses. Hence it is only necessary to create a root partition ( / ), and possibly an additional partition for /home or /opt ( often as ext4, but any suitable linux partition type can be used by preference). A linux swap partition may also be desirable and in this use case it is no different to a standard Archlinux install. For an existing UEFI system the main hard drive will have a GPT partition table, and from the Archlinux install iso, once booted, the gdisk facility is simple to use to create the additional linux partitions.
+
===== refind_linux.conf =====
  
Once the partitions have been created then a filesystem must be created in each new partition except swap.
+
If rEFInd automatically detects your kernel, you can place a {{ic|refind_linux.conf}} file containing the kernel parameters in the same directory as your kernel. You can use {{ic|/usr/share/refind/refind_linux.conf-sample}} as a starting point. The first uncommented line of {{ic|refind_linux.conf}} will be the default parameters for the kernel. Subsequent lines will create entries in a submenu accessible using {{ic|+}}, {{ic|F2}}, or {{ic|Insert}}.
  
This can be done using for example mkfs -t ext4 /dev/sdXY as necessary for each new linux partition.
+
{{hc|/boot/refind_linux.conf|2=
 +
"Boot using default options"    "root=PARTUUID=''XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX'' rw add_efi_memmap"
 +
"Boot using fallback initramfs"  "root=PARTUUID=''XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX'' rw add_efi_memmap initrd=/boot/initramfs-linux-fallback.img"
 +
"Boot to terminal"              "root=PARTUUID=''XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX'' rw add_efi_memmap systemd.unit=multi-user.target"
 +
}}
  
The only difference between a dual boot system and the pure linux install described in the first section of this page, is that the rEFInd files are placed in a new directory that is
+
Alternatively, try running:
created in the pre-existing EFI, leaving the existing directories and files for Windows and recovery binary files untouched.
 
  
Hence create a new directory within the EFI:
+
# mkrlconf
  
/boot/efi/EFI/refind
+
Which will attempt to find your kernel in {{ic|/boot}} and automatically generate {{ic|refind_linux.conf}}. The script will only set up the most basic kernel parameters, so be sure to check the file it created for correctness.
  
Then install rEFInd as in the pure linux case above, and copy the same set of files and directories as above into this directory.
+
If you do not specify an {{ic|1=initrd=}} parameter, rEFInd will automatically add it by searching for common RAM disk filenames in the same directory as the kernel. If you need multiple {{ic|1=initrd=}} parameters, you must specify them manually in {{ic|refind_linux.conf}}. For example, a [[microcode]] passed before the initramfs:
  
The remainder of the install is the same as for a pure Archlinux install.
+
"Boot using default options"    "root=PARTUUID=''XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX'' rw add_efi_memmap initrd=/boot/intel-ucode.img initrd=/boot/amd-ucode.img initrd=/boot/initramfs-linux.img"
  
Once the remainder of the Archlinux install is complete, then booting the new system should result in the rEFInd screen with Archlinux as the default entry visible, but with additional icons visible for booting Windows 8.1 as well as Recovery to Factory Settings if this was provided by the original manufacturer. Note that if the Recovery boot is initiated it will overwrite the linux partitions, and so would normally only be used in the event that the Windows 8.1 system was unrecoverable, in which case Archlinux would then need to be installed again from scratch.
+
{{Note|Specifying {{ic|1=initrd=}} in {{ic|/boot/refind_linux.conf}} will prevent you from using the same kernel options for multiple kernels.}}
  
== Upgrading rEFInd ==
+
{{Warning|{{ic|initrd}} path is relative to the root of the file system on which the kernel resides. This could be {{ic|1=initrd=/boot/initramfs-linux.img}} or, if ESP is mounted to {{ic|/boot}}, {{ic|1=initrd=/initramfs-linux.img}}.}}
  
When a new version of the refind package is installed as an update via pacman, then all that is necessary is to copy the refind directories and files, except the refind.conf and refind_linux.conf as in the pure Archlinux install section above.
+
===== Without configuration =====
  
To automatically update rEFInd to the latest version, you could run refind-install (in cronjob) as alternative to the systemd script below.
+
{{Expansion|Add "Full auto detection" using Discoverable Partitions Specification and {{ic|/etc/fstab}} reading.}}
The command will be executed as follow:
 
{{hc|/usr/bin/refind-install|<nowiki>
 
Installing rEFInd on Linux....
 
ESP was found at /boot/efi using vfat
 
Found rEFInd installation in /boot/efi/EFI/refind; upgrading it.
 
Installing driver for ext4 (ext4_x64.efi)
 
Copied rEFInd binary files
 
  
Notice: Backed up existing icons directory as icons-backup.
+
As a fallback mechanism rEFInd can:
Existing refind.conf file found; copying sample file as refind.conf-sample
 
to avoid overwriting your customizations.
 
  
rEFInd has been set as the default boot manager.
+
* Identify the root partition (for {{ic|1=root=}} parameter ) via the [https://www.freedesktop.org/wiki/Specifications/DiscoverablePartitionsSpec/ Discoverable Partitions Specification] or {{ic|/etc/fstab}}.
Existing //boot/refind_linux.conf found; not overwriting.
+
* Detect kernel options ({{ic|ro}} or {{ic|rw}}) from [[Wikipedia:GUID Partition Table#Partition entries (LBA 2-33)|GPT partition attributes]] (using attribute {{ic|60}} "read-only") or {{ic|/etc/fstab}}.
  
Installation has completed successfully.
+
{{Note|rEFInd does not support escape codes (e.g. for [[fstab#Filepath spaces|spaces]]) in {{ic|/etc/fstab}}.}}
</nowiki>}}
 
  
== Systemd Automation (Upgrading) ==
+
==== Manual boot stanzas ====
  
To automate the process of copying refind files and updating the nvram (if needed) use the following script.
+
If your kernel is not autodetected, or if you simply want more control over the options for a menu entry, you can manually create boot entries using stanzas in {{ic|refind.conf}}. Ensure that {{ic|scanfor}} includes {{ic|manual}} or these entries will not appear in rEFInd's menu. Kernel parameters are set with the {{ic|options}} keyword. rEFInd will append the {{ic|1=initrd=}} parameter using the file specified by the {{ic|initrd}} keyword in the stanza. If you need additional initrds (e.g. for [[Microcode]]), you can specify them in {{ic|options}} (and the one specified by the {{ic|initrd}} keyword will be added to the end).
  
{{Note|If you want to change the directory that refind is installed in the UEFISYS partition, just change the value of $refind_dir in the script}}
+
Manual boot stanzas are explained in [https://www.rodsbooks.com/refind/configfile.html#stanzas Creating Manual Boot Stanzas].
{{hc|/usr/lib/systemd/scripts/refind_name_patchv2|<nowiki>
 
#!/usr/bin/env bash
 
## COPYRIGHT 2013 : MARK E. LEE (BLUERIDER) : mlee24@binghamton.edu; mark@markelee.com
 
  
## LOG
+
{{hc|''esp''/EFI/refind/refind.conf|2=
## 1/17/2013 : Version 2 of refind_name_patch is released
+
...
##          : Supports long subdirectory location for refind
 
##          : Updates nvram when needed
 
##          : 10% speed boost
 
## 7/15/2013 : Changed arch to match 32-bit (ia32) and 64-bit (x64) naming scheme
 
##          : Changed directory copying in update-efi-dir to copy tools and drivers directories explicitly
 
##          : Changed efibootmgr writing code to be more concise and added (-w) to write the entry as per dusktreader's excellent guide : https://docs.google.com/document/d/1pvgm3BprpXoadsQi38FxqMOCUZhcSqFhZ26FZBkmn9I/edit
 
##          : Function to check if NVRAM boot entry was already listed was fixed to use awk and an if then clause
 
##          : ref_bin_escape was modified from : ref_bin_escape=${ref_bin//\//\\\\} to remove extra backslashes (error does not show up when using cmdline)
 
## 7/29/2013 : Changed location of tools,drivers, and binary directory to match capricious upstream move to /usr/share/refind
 
  
function main () { ## main insertion function
+
menuentry "Arch Linux" {
   declare -r refind_dir="/boot/efi/EFI/refind"; ## set the refind directory
+
icon    /EFI/refind/icons/os_arch.png
  arch=$(uname -m | awk -F'_' '{if ($1 == "x86") {print "x"$2} else if ($1 == "i686") {print "ia32"}}') &&  ## get bit architecture
+
volume   "Arch Linux"
  update-efi-dir;  ## updates or creates the refind directory
+
loader  /boot/vmlinuz-linux
  update-efi-nvram;  ## updates nvram if needed
+
initrd  /boot/initramfs-linux.img
 +
options  "root=PARTUUID=''XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX'' rw add_efi_memmap"
 +
submenuentry "Boot using fallback initramfs" {
 +
initrd /boot/initramfs-linux-fallback.img
 +
}
 +
submenuentry "Boot to terminal" {
 +
add_options "systemd.unit=multi-user.target"
 +
}
 
}
 
}
 +
}}
 +
 +
It is likely that you will need to change {{ic|volume}} to match either a filesystem's LABEL, a PARTLABEL, or a PARTUUID of the partition where the kernel image resides. See [[Persistent block device naming#by-label]] for examples of assigning a volume label. If {{ic|volume}} is not specified it defaults to volume from which rEFInd was launched (typically EFI System Partition).
 +
 +
{{Warning|{{ic|loader}} and {{ic|initrd}} paths are relative to the root of {{ic|volume}}.}}
 +
 +
== Installation alongside an existing UEFI Windows installation ==
  
function update-efi-dir () { ## setup the refind directory
+
{{Note|The usual caveats of [[Dual boot with Windows]] apply.}}
  if [ ! -d $refind_dir ]; then  ## check if refind directory exists
+
 
    echo "Couldn't find $refind_dir";
+
rEFInd is compatible with the EFI system partition created by a UEFI Windows installation, so there is no need to create or format another FAT32 partition when installing Arch alongside Windows. Simply mount the existing ESP and install rEFInd as usual. By default, rEFInd's autodetection feature should recognize any existing Windows/recovery bootloaders.
    mkdir $refind_dir && ## make the refind directory if needed
+
 
    echo "Made $refind_dir";
+
{{Note|In some cases, Windows behaves differently (low resolution boot screen, OEM logo replaced by Windows logo, black screen after boot screen, artifacting). If you face such issues, try setting {{ic|use_graphics_for +,windows}} in {{ic|''esp''/EFI/refind/refind.conf}} or adding {{ic|graphics on}} to the Windows boot stanza.}}
  fi;
+
 
  if [ "$arch" ]; then ## check if anything was stored in $arch
+
== Tools ==
    cp -r /usr/share/refind/{refind_$arch.efi,keys,images,icons,fonts,docs,{tools,drivers}_$arch} $refind_dir/ && ## update the bins and dirs
+
 
    echo "Updated binaries and directory files for refind at $refind_dir";
+
{{Move|Unified Extensible Firmware Interface|Although rEFInd has a special interface for these common tools, they are not a feature of rEFInd.}}
  else
+
 
    echo "Failed to detect an x86 architecture";
+
rEFInd supports running various [https://www.rodsbooks.com/refind/installing.html#addons 3rd-party tools]. Tools need to be installed separately. Edit {{ic|showtools}} in {{ic|refind.conf}} to choose which ones to show.
    exit;
+
 
  fi;
+
{{hc|''esp''/EFI/refind/refind.conf|
}
+
...
 +
showtools [[#UEFI shell|shell]], [[#Memtest86|memtest]], [[#Key management tools|mok_tool]], [[#GPT fdisk (gdisk)|gdisk]], [[#iPXE|netboot]], [[#fwupdate|fwupdate]] ...
 +
...
 +
}}
 +
 
 +
=== UEFI shell ===
 +
 
 +
See [[Unified Extensible Firmware Interface#UEFI Shell]].
 +
 
 +
Copy {{ic|shellx64.efi}} to the root of the [[EFI system partition]].
 +
 
 +
=== Memtest86 ===
 +
 
 +
Install {{AUR|memtest86-efi}} and copy it to {{ic|''esp''/EFI/tools/}}.
 +
 
 +
  # cp /usr/share/memtest86-efi/bootx64.efi ''esp''/EFI/tools/memtest86.efi
 +
 
 +
=== Key management tools ===
 +
 
 +
rEFInd can detect Secure Boot key management tools if they are placed in rEFInd's directory on ESP, {{ic|''esp''/}} or {{ic|''esp''/EFI/tools/}}.
 +
 
 +
==== HashTool ====
 +
 
 +
Follow [[#Using PreLoader]] and {{ic|HashTool.efi}} will be placed in rEFInd's directory.
 +
 
 +
==== MokManager ====
 +
 
 +
Follow [[#Using shim]] and MokManager will be placed in rEFInd's directory.
 +
 
 +
==== KeyTool ====
 +
 
 +
Install {{Pkg|efitools}}.
 +
 
 +
Place KeyTool EFI binary in {{ic|''esp''/}} or {{ic|''esp''/EFI/tools/}} with the name {{ic|KeyTool.efi}} or {{ic|KeyTool-signed.efi}}.
 +
 
 +
See [[Secure Boot#Using KeyTool]] for instructions on signing {{ic|KeyTool.efi}}.
 +
 
 +
=== GPT fdisk (gdisk) ===
 +
 
 +
Download the [[gdisk#gdisk EFI application|gdisk EFI application]] and copy {{ic|gdisk_x64.efi}} to {{ic|''esp''/EFI/tools/}}.
 +
 
 +
=== iPXE ===
 +
 
 +
{{Out of date|iPXE is not packaged in {{Pkg|refind-efi}} anymore.}}
 +
 
 +
{{Note|PXE support in rEFInd is '''experimental'''.}}
 +
 
 +
{{pkg|refind-efi}} contains the iPXE UEFI binaries, you just need to copy them to {{ic|''esp''/EFI/tools/}}.
 +
 
 +
# cp /usr/share/refind/tools_x64/ipxe_discovery_x64.efi ''esp''/EFI/tools/ipxe_discovery.efi
 +
# cp /usr/share/refind/tools_x64/ipxe_x64.efi ''esp''/EFI/tools/ipxe.efi
 +
 
 +
=== fwupdate ===
 +
 
 +
Install and setup [[fwupd]].
 +
 
 +
Copy the {{ic|fwupx64.efi}} binary and firmware files to {{ic|''esp''/EFI/tools/}}:
 +
 
 +
  # cp -r /usr/lib/fwupdate/EFI/arch/* ''esp''/EFI/tools/
 +
 
 +
== Tips and tricks ==
 +
 
 +
=== Using drivers in UEFI shell ===
 +
 
 +
To use rEFInd's drivers in UEFI shell load them using command {{ic|load}} and refresh mapped drives with {{ic|map -r}}.
 +
 
 +
Shell> load FS0:\EFI\refind\drivers\ext4_x64.efi
 +
Shell> map -r
 +
 
 +
Now you can access your file system from UEFI shell.
 +
 
 +
== Troubleshooting ==
 +
 
 +
=== Btrfs subvolume support ===
 +
 
 +
==== Auto detection ====
 +
 
 +
To allow kernel auto detection on a Btrfs subvolume uncomment and edit {{ic|also_scan_dirs}} in {{ic|refind.conf}}.
 +
 
 +
{{hc|''esp''/EFI/refind/refind.conf|
 +
...
 +
also_scan_dirs +,''subvolume''/boot
 +
...
 +
}}
 +
 
 +
Next add {{ic|1=subvol=''subvolume''}} to {{ic|1=rootflags}} in {{ic|refind_linux.conf}} and then prepend {{ic|''subvolume''}} to the initrd path.
  
function update-efi-nvram () { ## update the nvram with efibootmgr
+
{{hc|/boot/refind_linux.conf|2=
  declare -r ref_bin=${refind_dir/\/boot\/efi}/refind_$arch.efi;  ## get path of refind binary (without /boot/efi)
+
"Boot using standard options" "root=PARTUUID=''XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX'' rw '''rootflags=subvol=''subvolume''''' initrd='''''subvolume'''''/boot/initramfs-linux.img"
  declare -r ref_bin_escape=${ref_bin//\//\\};  ## insert escape characters into $ref_bin
+
}}
  [ "$(efibootmgr -v | awk "/${ref_bin_escape//\\/\\\\}/")" ] && ( ## check if boot entry is in nvram \
 
    echo "Found boot entry, no need to update nvram";
 
    ) || ( ## if boot entry is not in nvram; add it
 
    declare -r esp=$(mount -l | awk '/ESP/ {print $1}') &&  ## get ESP partition
 
    efibootmgr -cgw -d ${esp:0:8} -p ${esp:8} -L "rEFInd" -l $ref_bin_escape && ## update nvram
 
    echo "
 
    Updated nvram with entry rEFInd to boot $ref_bin
 
    Did not copy configuration files, please move refind.conf to $refind_dir/";
 
    )
 
}
 
main;  ## run the main insertion function
 
</nowiki>}}
 
  
{{hc|/usr/lib/systemd/system/refind_update.path|<nowiki>
+
==== Manual boot stanza ====
[Unit]
 
Description=Update rEFInd bootloader files
 
  
[Path]
+
If booting a [[btrfs]] subvolume as root, amend the {{ic|options}} line with {{ic|1=rootflags=subvol=''root_subvolume''}}. In the example below, root has been mounted as a btrfs subvolume called 'ROOT' (e.g. {{ic|1=mount -o subvol=ROOT /dev/sdxY /mnt}}):
PathChanged=/usr/share/refind/refind_<arch>.efi
 
Unit=refind_update.service
 
  
[Install]
+
{{hc|''esp''/EFI/refind/refind.conf|2=
WantedBy=multi-user.target
+
...
</nowiki>}}
+
menuentry "Arch Linux" {
 +
        icon    /EFI/refind/icons/os_arch.png
 +
        volume  "[bootdevice]"
 +
        loader  /boot/vmlinuz-linux
 +
        initrd  /boot/initramfs-linux.img
 +
        options  "root=PARTUUID=''XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX'' rw '''rootflags=subvol=ROOT'''"
 +
...
 +
}
 +
}}
  
{{hc|/usr/lib/systemd/system/refind_update.service|<nowiki>
+
A failure to do so will otherwise result in the following error message: {{ic|ERROR: Root device mounted successfully, but /sbin/init does not exist.}}
[Unit]
 
Description=Update rEFInd directories, binaries, and nvram
 
  
[Service]
+
=== Apple Macs ===
Type=oneshot
 
ExecStart=/usr/bin/bash /usr/lib/systemd/scripts/refind_name_patchv2
 
RemainAfterExit=no
 
</nowiki>}}
 
  
Enable the systemd path unit by running:
+
{{AUR|mactel-boot}} is an experimental ''bless'' utility for Linux. If that does not work, use ''bless'' from within OSX to set rEFInd as the default boot entry:
# systemctl enable refind_update.path
 
  
== Apple Macs ==
+
# bless --setBoot --folder ''esp''/EFI/refind --file ''esp''/EFI/refind/refind_x64.efi
  
In case of Apple Macs, try {{AUR|mactel-boot}} for an experimental "bless" utility for Linux. If that does not work, use "bless" from within OSX to set rEFInd as default bootloader. Assuming UEFISYS partition is mounted at {{ic|/mnt/efi}} within OSX, do
+
=== VirtualBox ===
  
$ sudo bless --setBoot --folder /mnt/efi/EFI/refind --file /mnt/efi/EFI/refind/refind_x64.efi
+
Currently, VirtualBox will only boot the default {{ic|''esp''/EFI/BOOT/bootx64.efi}} path, so {{ic|refind-install}} needs to be used with at least the {{ic|--usedefault}} option. See [[VirtualBox#Installation in EFI mode]] for more information.
  
== VirtualBox ==
+
== See also ==
  
In case of VirtualBox, see [[VirtualBox#Using_Arch_under_Virtualbox_EFI_mode]].
+
* [https://www.rodsbooks.com/refind/ The rEFInd Boot Manager] by Roderick W. Smith.
 +
* [[Wikipedia:rEFInd]]
 +
* {{ic|/usr/share/refind/docs/README.txt}}
 +
* [https://sourceforge.net/p/refind/discussion/ rEFInd discussion forum on Sourceforge]

Latest revision as of 07:49, 8 October 2018

rEFInd is a UEFI boot manager capable of launching EFISTUB kernels. It is a fork of the no-longer-maintained rEFIt and fixes many issues with respect to non-Mac UEFI booting. It is designed to be platform-neutral and to simplify booting multiple OSes.

Note: In the entire article esp denotes the mountpoint of the EFI system partition aka ESP.

Installation

Install the refind-efi package.

rEFInd has read-only drivers for ReiserFS, Ext2, Ext4, Btrfs, ISO-9660, HFS+, and NTFS. Additionally rEFInd can use drivers from the UEFI firmware i.e. FAT (and HFS+ on Macs or ISO-9660 on some systems).

Note: Your kernel and initramfs must reside on a file system that rEFInd can read.

To find additional drivers see The rEFInd Boot Manager: Using EFI Drivers: Finding Additional EFI Drivers.

Installation with refind-install script

The rEFInd package includes the refind-install script to simplify the process of setting rEFInd as your default EFI boot entry. The script has several options for handling differing setups and UEFI implementations. See refind-install(8) or read the comments in the install script for explanations of the various installation options.

For many systems it should be sufficient to simply run:

# refind-install

This will attempt to find and mount your ESP, copy rEFInd files to esp/EFI/refind/, and use efibootmgr to make rEFInd the default EFI boot application.

Alternatively you can install rEFInd to the default/fallback boot path esp/EFI/BOOT/bootx64.efi. This is helpful for bootable USB flash drives or on systems that have issues with the NVRAM changes made by efibootmgr:

# refind-install --usedefault /dev/sdXY

Where /dev/sdXY is of your EFI System Partition.

Note: By default refind-install installs only the driver for the file system on which kernel resides. Additional file systems need to be installed manually or you can install all drivers with the --alldrivers option. This is useful for bootable USB flash drives e.g.:
# refind-install --usedefault /dev/sdXY --alldrivers

After installing rEFInd's files to the ESP, verify that rEFInd has created refind_linux.conf containing the required kernel parameters (e.g. root=) in the same directory as your kernel. If it has not created this file, you will need to set up #Passing kernel parameters manually or you will most likely get a kernel panic on your next boot.

By default, rEFInd will scan all of your drives (that it has drivers for) and add a boot entry for each EFI bootloader it finds, which should include your kernel (since Arch enables EFISTUB by default). So you may have a bootable system at this point.

Tip: It is always a good idea to edit the default configuration file esp/EFI/refind/refind.conf to ensure that the default options work for you.
Warning: When refind-install is run in chroot (e.g. in live system when installing Arch Linux) /boot/refind_linux.conf is populated with kernel options from the live system not the one on which it is installed. You will need to edit /boot/refind_linux.conf and adjust the kernel options manually. See #refind_linux.conf for an example.

Secure Boot

See Managing Secure Boot for Secure Boot support in rEFInd.

Using PreLoader

See Secure Boot#Set up PreLoader to acquire signed PreLoader.efi and HashTool.efi binaries.

Execute refind-install with the option --preloader /path/to/preloader

# refind-install --preloader /usr/share/preloader-signed/PreLoader.efi

Next time you boot with Secure Boot enabled, HashTool will launch and you will need to enroll the hash of rEFInd (loader.efi), rEFInd's drivers (e.g. ext4_x64.efi) and kernel (e.g. vmlinuz-linux).

See refind-install(8) for more information.

Tip: The signed HashTool is only capable of accessing the partition it was launched from. This means if your kernel is not on the ESP, you will not be able to enroll its hash from HashTool. You can workaround this by using #KeyTool, since it is capable of enrolling a hash in MokList and is not limited to one partition. Remember to enroll KeyTool's hash before using it.
Using shim

Install shim-signedAUR. Read Secure Boot#shim, but skip all file copying.

Using hashes

To use only hashes with shim, execute refind-install with the option --shim /path/to/shim

# refind-install --shim /usr/share/shim-signed/shimx64.efi

Next time you boot with Secure Boot enabled, MokManager will launch and you will need to enroll the hash of rEFInd (grubx64.efi), rEFInd's drivers (e.g. ext4_x64.efi) and kernel (e.g. vmlinuz-linux).

Using Machine Owner Key

To sign rEFInd with a Machine Owner Key (MOK), install sbsigntools.

Tip: If you already have created a MOK, place the files in the directory /etc/refind.d/keys with the names refind_local.key (PEM format private key), refind_local.crt (PEM format certificate) and refind_local.cer (DER format certificate).

Execute refind-install with the options --shim /path/to/shim and --localkeys:

# refind-install --shim /usr/share/shim-signed/shimx64.efi --localkeys

refind-install will create the keys for you and sign itself and its drivers. You will need to sign the kernel with the same key, e.g.:

# sbsign --key /etc/refind.d/keys/refind_local.key --cert /etc/refind.d/keys/refind_local.crt --output /boot/vmlinuz-linux /boot/vmlinuz-linux
Tip: The kernel signing can be automated with a pacman hook, e.g.:
/etc/pacman.d/hooks/999-sign_kernel_for_secureboot.hook
[Trigger]
Operation = Install
Operation = Upgrade
Type = Package
Target = linux

[Action]
Description = Signing kernel with Machine Owner Key for Secure Boot
When = PostTransaction
Exec = /usr/bin/sbsign --key /etc/refind.d/keys/refind_local.key --cert /etc/refind.d/keys/refind_local.crt --output /boot/vmlinuz-linux /boot/vmlinuz-linux
Depends = sbsigntools

Once in MokManager add refind_local.cer to MoKList. refind_local.cer can be found inside a directory called keys in the rEFInd's installation directory, e.g. esp/EFI/refind/keys/refind_local.cer.

See refind-install(8) for more information.

Using your own keys

Follow Secure Boot#Using your own keys to create keys.

Create directory /etc/refind.d/keys and place Signature Database (db) key and certificates in it. Name the files: refind_local.key (PEM format private key), refind_local.crt (PEM format certificate) and refind_local.cer (DER format certificate).

When running install script add option --localkeys, e.g.:

# refind-install --localkeys

rEFInd EFI binaries will be signed with the supplied key and certificate.

Manual installation

Tip: rEFInd can boot Linux in many ways. See The rEFInd Boot Manager: Methods of Booting Linux for coverage of the various approaches.

If the refind-install script does not work for you, rEFInd can be set up manually.

First, copy the executable to the ESP:

# mkdir -p esp/EFI/refind
# cp /usr/share/refind/refind_x64.efi esp/EFI/refind/

If you want to install rEFInd to the default/fallback boot path replace esp/EFI/refind/ with esp/EFI/BOOT/ in the following instructions and copy rEFInd EFI executable to esp/EFI/BOOT/bootx64.efi:

# mkdir -p esp/EFI/BOOT
# cp /usr/share/refind/refind_x64.efi esp/EFI/BOOT/bootx64.efi

Then use efibootmgr to create a boot entry in the UEFI NVRAM, where /dev/sdX and Y are the device and partition number of your EFI System Partition. If you are installing rEFInd to the default/fallback boot path esp/EFI/BOOT/bootx64.efi, you can skip this step.

# efibootmgr --create --disk /dev/sdX --part Y --loader /EFI/refind/refind_x64.efi --label "rEFInd Boot Manager" --verbose

At this point, you should be able to reboot into rEFInd, but it will not be able to boot your kernel. If your kernel does not reside on your ESP, rEFInd can mount your partitions to find it - provided it has the right drivers.

rEFInd automatically loads all drivers from the subdirectories drivers and drivers_arch (e.g. drivers_x64) in its install directory.

# mkdir esp/EFI/refind/drivers_x64
# cp /usr/share/refind/drivers_x64/drivername_x64.efi esp/EFI/refind/drivers_x64/

Now rEFInd should have a boot entry for your kernel, but it will not pass the correct kernel parameters. Set up #Passing kernel parameters. You should now be able to boot your kernel using rEFInd. If you are still unable to boot or if you want to tweak rEFInd's settings, many options can be changed with a configuration file:

# cp /usr/share/refind/refind.conf-sample esp/EFI/refind/refind.conf

The sample configuration file is well commented and self-explanatory.

Unless you have set textonly in the configuration file, you should copy rEFInd's icons to get rid of the ugly placeholders:

# cp -r /usr/share/refind/icons esp/EFI/refind/

You can try out different fonts by copying them and changing the font setting in refind.conf:

# cp -r /usr/share/refind/fonts esp/EFI/refind/
Tip: Pressing F10 in rEFInd will save a screenshot to the top level directory of the ESP.

Upgrading

Pacman updates the rEFInd files in /usr/share/refind/ and will not copy new files to the ESP for you. If refind-install worked for your original installation of rEFInd, you can rerun it to copy the updated files. The new configuration file will be copied as refind.conf-sample so that you can integrate changes into your existing configuration file using a diff tool. If your rEFInd required #Manual installation, you will need to figure out which files to copy yourself.

Pacman hook

You can automate the update process using a pacman hook:

/etc/pacman.d/hooks/refind.hook
[Trigger]
Operation=Upgrade
Type=Package
Target=refind-efi

[Action]
Description = Updating rEFInd on ESP
When=PostTransaction
Exec=/usr/bin/refind-install

Where the Exec= may need to be changed to the correct update command for your setup. If you did #Manual installation, you could create your own update script to call with the hook.

Tip: If you setup rEFInd with #Secure Boot, you may want to additionally add the option --yes to the refind-install command. It will prevent the command from failing if it gets executed when Secure Boot is disabled. See refind-install(8) for more information.

Configuration

The rEFInd configuration refind.conf is located in the same directory as the rEFInd EFI application (usually esp/EFI/refind or esp/EFI/BOOT). The default configuration file contains extensive comments explaining all its options, see Configuring the Boot Manager for more detailed explanations.

Passing kernel parameters

There are two methods for setting the kernel parameters that rEFInd will pass to the kernel.

For kernels automatically detected by rEFInd

For automatically detected kernels you can either specify the kernel parameters explicitly in /boot/refind_linux.conf or rely on rEFInd's ability to identify the root partition and kernel parameters. See Methods of Booting Linux: For Those With Foresight or Luck: The Easiest Method for more information.

Tip: rEFInd will automatically choose the Arch Linux icon (os_arch.png) for the boot entry when /etc/os-release is on the same partition as the kernel. If your /boot is a separate partition see Configuring the Boot Manager: Setting OS Icons.

For rEFInd to properly match multiple kernels with their respective initramfs you must uncomment and edit extra_kernel_version_strings option in refind.conf. E.g.:

esp/EFI/refind/refind.conf
...
extra_kernel_version_strings linux-hardened,linux-zen,linux-lts,linux
...
Note: rEFInd only supports detecting one initramfs image per kernel, meaning it will not detect fallback initramfs nor microcode images.
refind_linux.conf

If rEFInd automatically detects your kernel, you can place a refind_linux.conf file containing the kernel parameters in the same directory as your kernel. You can use /usr/share/refind/refind_linux.conf-sample as a starting point. The first uncommented line of refind_linux.conf will be the default parameters for the kernel. Subsequent lines will create entries in a submenu accessible using +, F2, or Insert.

/boot/refind_linux.conf
"Boot using default options"     "root=PARTUUID=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX rw add_efi_memmap"
"Boot using fallback initramfs"  "root=PARTUUID=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX rw add_efi_memmap initrd=/boot/initramfs-linux-fallback.img"
"Boot to terminal"               "root=PARTUUID=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX rw add_efi_memmap systemd.unit=multi-user.target"

Alternatively, try running:

# mkrlconf

Which will attempt to find your kernel in /boot and automatically generate refind_linux.conf. The script will only set up the most basic kernel parameters, so be sure to check the file it created for correctness.

If you do not specify an initrd= parameter, rEFInd will automatically add it by searching for common RAM disk filenames in the same directory as the kernel. If you need multiple initrd= parameters, you must specify them manually in refind_linux.conf. For example, a microcode passed before the initramfs:

"Boot using default options"     "root=PARTUUID=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX rw add_efi_memmap initrd=/boot/intel-ucode.img initrd=/boot/amd-ucode.img initrd=/boot/initramfs-linux.img"
Note: Specifying initrd= in /boot/refind_linux.conf will prevent you from using the same kernel options for multiple kernels.
Warning: initrd path is relative to the root of the file system on which the kernel resides. This could be initrd=/boot/initramfs-linux.img or, if ESP is mounted to /boot, initrd=/initramfs-linux.img.
Without configuration

Tango-view-fullscreen.pngThis article or section needs expansion.Tango-view-fullscreen.png

Reason: Add "Full auto detection" using Discoverable Partitions Specification and /etc/fstab reading. (Discuss in Talk:REFInd#)

As a fallback mechanism rEFInd can:

Note: rEFInd does not support escape codes (e.g. for spaces) in /etc/fstab.

Manual boot stanzas

If your kernel is not autodetected, or if you simply want more control over the options for a menu entry, you can manually create boot entries using stanzas in refind.conf. Ensure that scanfor includes manual or these entries will not appear in rEFInd's menu. Kernel parameters are set with the options keyword. rEFInd will append the initrd= parameter using the file specified by the initrd keyword in the stanza. If you need additional initrds (e.g. for Microcode), you can specify them in options (and the one specified by the initrd keyword will be added to the end).

Manual boot stanzas are explained in Creating Manual Boot Stanzas.

esp/EFI/refind/refind.conf
...

menuentry "Arch Linux" {
	icon     /EFI/refind/icons/os_arch.png
	volume   "Arch Linux"
	loader   /boot/vmlinuz-linux
	initrd   /boot/initramfs-linux.img
	options  "root=PARTUUID=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX rw add_efi_memmap"
	submenuentry "Boot using fallback initramfs" {
		initrd /boot/initramfs-linux-fallback.img
	}
	submenuentry "Boot to terminal" {
		add_options "systemd.unit=multi-user.target"
	}
}

It is likely that you will need to change volume to match either a filesystem's LABEL, a PARTLABEL, or a PARTUUID of the partition where the kernel image resides. See Persistent block device naming#by-label for examples of assigning a volume label. If volume is not specified it defaults to volume from which rEFInd was launched (typically EFI System Partition).

Warning: loader and initrd paths are relative to the root of volume.

Installation alongside an existing UEFI Windows installation

Note: The usual caveats of Dual boot with Windows apply.

rEFInd is compatible with the EFI system partition created by a UEFI Windows installation, so there is no need to create or format another FAT32 partition when installing Arch alongside Windows. Simply mount the existing ESP and install rEFInd as usual. By default, rEFInd's autodetection feature should recognize any existing Windows/recovery bootloaders.

Note: In some cases, Windows behaves differently (low resolution boot screen, OEM logo replaced by Windows logo, black screen after boot screen, artifacting). If you face such issues, try setting use_graphics_for +,windows in esp/EFI/refind/refind.conf or adding graphics on to the Windows boot stanza.

Tools

Tango-go-next.pngThis article or section is a candidate for moving to Unified Extensible Firmware Interface.Tango-go-next.png

Notes: Although rEFInd has a special interface for these common tools, they are not a feature of rEFInd. (Discuss in Talk:REFInd#)

rEFInd supports running various 3rd-party tools. Tools need to be installed separately. Edit showtools in refind.conf to choose which ones to show.

esp/EFI/refind/refind.conf
...
showtools shell, memtest, mok_tool, gdisk, netboot, fwupdate ...
...

UEFI shell

See Unified Extensible Firmware Interface#UEFI Shell.

Copy shellx64.efi to the root of the EFI system partition.

Memtest86

Install memtest86-efiAUR and copy it to esp/EFI/tools/.

# cp /usr/share/memtest86-efi/bootx64.efi esp/EFI/tools/memtest86.efi

Key management tools

rEFInd can detect Secure Boot key management tools if they are placed in rEFInd's directory on ESP, esp/ or esp/EFI/tools/.

HashTool

Follow #Using PreLoader and HashTool.efi will be placed in rEFInd's directory.

MokManager

Follow #Using shim and MokManager will be placed in rEFInd's directory.

KeyTool

Install efitools.

Place KeyTool EFI binary in esp/ or esp/EFI/tools/ with the name KeyTool.efi or KeyTool-signed.efi.

See Secure Boot#Using KeyTool for instructions on signing KeyTool.efi.

GPT fdisk (gdisk)

Download the gdisk EFI application and copy gdisk_x64.efi to esp/EFI/tools/.

iPXE

Tango-view-refresh-red.pngThis article or section is out of date.Tango-view-refresh-red.png

Reason: iPXE is not packaged in refind-efi anymore. (Discuss in Talk:REFInd#)
Note: PXE support in rEFInd is experimental.

refind-efi contains the iPXE UEFI binaries, you just need to copy them to esp/EFI/tools/.

# cp /usr/share/refind/tools_x64/ipxe_discovery_x64.efi esp/EFI/tools/ipxe_discovery.efi
# cp /usr/share/refind/tools_x64/ipxe_x64.efi esp/EFI/tools/ipxe.efi

fwupdate

Install and setup fwupd.

Copy the fwupx64.efi binary and firmware files to esp/EFI/tools/:

# cp -r /usr/lib/fwupdate/EFI/arch/* esp/EFI/tools/

Tips and tricks

Using drivers in UEFI shell

To use rEFInd's drivers in UEFI shell load them using command load and refresh mapped drives with map -r.

Shell> load FS0:\EFI\refind\drivers\ext4_x64.efi
Shell> map -r

Now you can access your file system from UEFI shell.

Troubleshooting

Btrfs subvolume support

Auto detection

To allow kernel auto detection on a Btrfs subvolume uncomment and edit also_scan_dirs in refind.conf.

esp/EFI/refind/refind.conf
...
also_scan_dirs +,subvolume/boot
...

Next add subvol=subvolume to rootflags in refind_linux.conf and then prepend subvolume to the initrd path.

/boot/refind_linux.conf
"Boot using standard options"  "root=PARTUUID=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX rw rootflags=subvol=subvolume initrd=subvolume/boot/initramfs-linux.img"

Manual boot stanza

If booting a btrfs subvolume as root, amend the options line with rootflags=subvol=root_subvolume. In the example below, root has been mounted as a btrfs subvolume called 'ROOT' (e.g. mount -o subvol=ROOT /dev/sdxY /mnt):

esp/EFI/refind/refind.conf
...
menuentry "Arch Linux" {
        icon     /EFI/refind/icons/os_arch.png
        volume   "[bootdevice]"
        loader   /boot/vmlinuz-linux
        initrd   /boot/initramfs-linux.img
        options  "root=PARTUUID=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX rw rootflags=subvol=ROOT"
...
}

A failure to do so will otherwise result in the following error message: ERROR: Root device mounted successfully, but /sbin/init does not exist.

Apple Macs

mactel-bootAUR is an experimental bless utility for Linux. If that does not work, use bless from within OSX to set rEFInd as the default boot entry:

# bless --setBoot --folder esp/EFI/refind --file esp/EFI/refind/refind_x64.efi

VirtualBox

Currently, VirtualBox will only boot the default esp/EFI/BOOT/bootx64.efi path, so refind-install needs to be used with at least the --usedefault option. See VirtualBox#Installation in EFI mode for more information.

See also