EFI settings set via efibootmgr are ignored after reboot

Question

I have 2 disks (/dev/sda and /dev/sdb) on UEFI laptop. Both GPT.

sda1 - NTFS  - Windows,
sda2 - FAT32 - EFI partition where is Windows Boot Manager and GRUB

sdb1 - NTFS  - another windows 
sdb2 - NTFS  - My data
sdb3 - FAT32 - EFI partition
sdb4 - EXT4  - Debian

in EFI order i can see Windows Boot Manager and GRUB. I can change between then and thats working. I consider to use syslinux to boot to debian. I want to have syslinux on sdb3, I mounted that and copy these files to this partition at the location:

/EFI/SYSLINUX/initrd.img
/EFI/SYSLINUX/ldlinux.e64
/EFI/SYSLINUX/syslinux.cfg
/EFI/SYSLINUX/syslinux.efi
/EFI/SYSLINUX/vmlinuz

vmlinuz and initrd i copied from sdb4\boot and rename. syslinux.efi and ldlinux.e64 i copied from syslinux-6.03.tar.gz downloaded from http://kernel.org. syslinux.cfg i wrote and contents is

PROMPT 0
TIMEOUT 300
DEFAULT deb

LABEL deb
    LINUX vmlinuz
    APPEND ROOT=/dev/sdb4
    INITRD initrd.img

then i added record to EFI via command

efibootmgr -c -d /dev/sdb3 -p 1 -l \\EFI\\SYSLINUX\\syslinux.efi -L "SYSLINUX2"

efiboot manager responded success and shows SYSLINUX2 as boot options but when i reboot computer (by reboot command) and goes to UEFI settings, there is no SYSLINUX2 option added. There are only GRUB and Windows Boot Manager. After next boot to debian, efibootmgr too responses only Windows Boot Manager and GRUB.

I have read that some people had problems with secure boot. I have disabled it and GRUB have not problem with this.

What is wrong? How to make efibootmgr setting persistent? Where i did mistake (if any)?

Answer 1

Like the OP, I was seeing old, invalid entries when using efibootmgr. I tried to remove them with the -B option, and it appeared to work, but on reboot, the old list would be back and my changes lost.

The solution for me, on a Thinkpad, was to go into BIOS Setup and set "Boot Order Lock" on the Boot tab to Disabled. When it is Enabled you cannot modify the boot entries. Hope this helps someone else out!

Answer 2

You're seeing a bug, and it's almost certainly not related to Secure Boot. I have several suggestions, but none is guaranteed to fix the problem:

• Update your firmware -- If the bug is in the firmware, updating it may fix the problem. Check with the computer's (or motherboard's) manufacturer to find updates. (They're probably called "BIOS updates," although technically your firmware is not a BIOS.) After the update, reboot into Linux and try again.
• Reset your firmware to its default settings -- Sometimes EFI boot manager lists become corrupted, causing symptoms like those you describe. Resetting all the firmware settings to their defaults in the setup utility may fix this problem. Unfortunately, this step will remove any working boot manager entries, so you may need to use an emergency tool (such as my rEFInd boot manager on a USB drive or CD-R) to boot until you re-create your working entries.
• Delete unused boot manager entries -- Deleting unused boot manager entries (with the -B option to efibootmgr) can also work around corrupted entries. Try efibootmgr alone, or efibootmgr -v for more verbose output, to locate duplicate or unwanted entries. (Note that the firmware may re-create some automatically when you reboot. This may happen with network boot options or options to boot external media, for instance.)
• Use another tool to create the boot entry -- Sometimes efibootmgr doesn't work but a tool in another OS (like bcdedit or EasyUEFI in Windows) or the bcfg tool in an EFI shell will get the job done. Thus, you might try these tools instead of efibootmgr.
• Use a fallback filename -- The fallback filename (EFI/BOOT/bootx64.efi on x86-64 systems) can be used if nothing else is working; however, this filename will typically be the last one a computer tries to boot. Thus, if it's already booting via some other name (like the Windows boot loader, EFI/Microsoft/Boot/bootmgfw.efi), you may need to back that up, rename your desired boot manager/loader to the currently-booting default, and reconfigure the new boot loader to offer to boot the one it's masquerading as using its new name. This is a bit of a juggling act at best, and not all EFI boot loaders for Linux can chainload to another EFI program, so it may not work properly. (I don't recall offhand if SYSLINUX can chainload another EFI program.)
• Switch to BIOS/CSM/legacy booting -- Most EFIs provide a Compatibility Support Module (CSM), which enables them to boot BIOS-mode boot loaders. Thus, you can install a BIOS-mode boot loader for Linux, activate the CSM, and boot in this way. If you're dual-booting another OS, though, you'll need to install its BIOS-mode boot loader, too, and this may necessitate changing from GPT to MBR partitioning. Overall, this approach is likely to be a bit of a pain; but on some EFIs (mostly old ones from 2011 or thereabouts), it may be the best approach.
• Return the computer for a refund -- If all else fails, and if the computer is within its store return period, you can return it for one that works. In fact, I recommend this approach before either of the preceding two options, if possible. If you do this, be sure to contact the manufacturer to tell them why you returned the computer. EFIs have had serious bugs from Day One, and some manufacturers have been slow to fix them, in part because their customers never complain, so the manufacturers don't realize how serious the bugs are.

Answer 3

UPDATE:

Hi there, me again,

started to work on it again, now fixed with renaming the .efi file to the windows equivalent (bootmgfw.efi), then remounted the efivar file system efivarfs like in the above description, then set the uefi boot entry in the VRAM by typing

efibootmgr -c -d /dev/sda -p 4 -L "linuxmint_grub" -l "\EFI\linuxmint_grub\bootmgfw.efi"

with having the ESP on /dev/sda, partition 4.

No booting works flawlessly, efibootmgr entry remains persistently, only drawback: GRUB starting up at boot time automatically despite having it turned off. Seems to be a GRUB issue, gonna fix that later.

Cheers and hope I could help ;)

Answer 4

I'm having the same problem, trying to create efi boot entry under Intel NUC7I5BBNK and LinuxMint 18.3 with ESP mounted on /boot. Efibootmgr creates entry successfully and persistently, however it is not accessible, not shown under EFI visual boot menu and automatically shown boot entry in Intel BIOS only shows "no valid boot partition has been detected". Also I found the boot order, no matter how often I correct it, is not persistent, am gonna try to remount with

mount -o remount,rw -t efivarfs efivarfs /sys/firmware/efi/efivars

although it's already mounted "rw" as shown by

mount | grep efivars

and try again. (For further advise, see https://wiki.gentoo.org/wiki/Efibootmgr).

Choosing efi variables directly from the UEFI visual bios menu wasn't possible, I can visually see it from the built file explore, but am not able to select it.

Another option would be to install .efi-Variables in Secure Boot mode, which isn't my favourite. Maybe that's a better fit for my UEFI implementation. All installs need custom adjustment!

Secondly tried to install EFI entry with efibootmgr on ASUS V3-371-KT51 laptop, didn't work at all --> really shows how it depends on the machine and the UEFI implementation. Worked (kind of) with selecting .efi file from the UEFI menu manually, but only in Secure Boot mode.

bcfg method as suggested by another post is for direct boot only, which means neglecting the boot manager (EFISTUB, as far as I know, don't take that for granted, please check that out for yourself, like here: https://wiki.archlinux.org/index.php/EFISTUB )

BTW: 3 mistakes apparent to me:

1. -d stands for "disk", other than "partition", which means you should change it to "/dev/sdb" if your ESP is on /dev/sdb

2. -p stands for the partition number, in your case "3" (or "2", depending on how efibootmgr resp. the UEFI implement. is counting)

   So try to change that.

3. Last but not least, I successfully booted a UEFI flash drive with having all kernel, initrd files and what not to /boot, unlike your suggested /boot/EFI/syslinux directory. This is the usual way to go.

Hope, that was helpful, good luck for you and take care ;)