Unified Extensible Firmware Interface

From ArchWiki

Related articles

The Unified Extensible Firmware Interface (UEFI, successor of the EFI) is an interface between operating systems and firmware. It provides a standard environment for booting an operating system and running pre-boot applications.

It is distinct from the "MBR boot code" method that was used by legacy BIOS systems. See Arch boot process for their differences and the boot process using UEFI. To set up UEFI boot loaders, see Arch boot process#Boot loader.

Note: Early vendor UEFI implementations may carry more bugs than their BIOS counterparts. Consider using legacy BIOS booting for such systems if you encounter unsolvable issues.

UEFI versions

  • UEFI started as Intel's EFI in versions 1.x.
  • Later, a group of companies called the UEFI Forum took over its development, which renamed it as Unified EFI starting with version 2.0.
  • Unless specified as EFI 1.x, EFI and UEFI terms are used interchangeably to denote UEFI 2.x firmware.
  • Apple's EFI implementation is neither an EFI 1.x version nor UEFI 2.x version but mixes up both. This kind of firmware does not fall under any one (U)EFI specification and therefore is not a standard UEFI firmware. Unless stated explicitly, these instructions are general and some of them may not work or may be different in Apple Macs.

The latest UEFI specification can be found at https://uefi.org/specifications.

UEFI firmware bitness

Under UEFI, every program whether it is an operating system loader or a utility (e.g. a memory testing or recovery tool), should be an EFI application corresponding to the UEFI firmware bitness/architecture.

The vast majority of x86_64 systems, including recent Apple Macs, use x64 (64-bit) UEFI firmware. The only known devices that use IA32 (32-bit) UEFI are older (pre 2008) Apple Macs, Intel Atom System-on-Chip systems (as on 2 November 2013)[1] and some older Intel server boards that are known to operate on Intel EFI 1.10 firmware.

An x64 UEFI firmware does not include support for launching 32-bit EFI applications (unlike x86_64 Linux and Windows versions which include such support). Therefore the EFI application must be compiled for that specific firmware processor bitness/architecture.

Note: Systems with IA32 UEFI require using a boot loader that supports mixed mode booting. For example, systemd-boot or GRUB (installed with the i386-efi target).

Checking the firmware bitness

The firmware bitness can be checked from a booted operating system.

From Linux

On distributions running Linux kernel 4.0 or newer, the UEFI firmware bitness can be found via the sysfs interface. Run: 

$ cat /sys/firmware/efi/fw_platform_size

It will return 64 for a 64-bit (x64) UEFI or 32 for a 32-bit (IA32) UEFI. If the file does not exist, then you have not booted in UEFI mode.

From macOS

Pre-2008 Macs mostly have IA32 EFI firmware while >=2008 Macs have mostly x64 EFI. All Macs capable of running Mac OS X Snow Leopard 64-bit Kernel have x64 EFI 1.x firmware.

To find out the arch of the EFI firmware in a Mac, type the following into the Mac OS X terminal: 

$ ioreg -l -p IODeviceTree | grep firmware-abi

If the command returns EFI32 then it is IA32 (32-bit) EFI firmware. If it returns EFI64 then it is x64 EFI firmware. Most of the Macs do not have UEFI 2.x firmware as Apple's EFI implementation is not fully compliant with UEFI 2.x specification.

From Microsoft Windows

64-bit versions of Windows do not support booting on a 32-bit UEFI. So, if you have a 32-bit version of Windows booted in UEFI mode, you have a 32-bit UEFI.

To check the bitness run msinfo32.exe. In the System Summary section look at the values of "System Type" and "BIOS mode".

For a 64-bit Windows on a 64-bit UEFI it will be System Type: x64-based PC and BIOS mode: UEFI, for a 32-bit Windows on a 32-bit UEFI - System Type: x86-based PC and BIOS mode: UEFI. If the "BIOS mode" is not UEFI, then Windows is not booted in UEFI mode.

Linux kernel configuration options for UEFI

The required Linux Kernel configuration options[2] for UEFI systems are: 

CONFIG_RELOCATABLE=y
CONFIG_EFI=y
CONFIG_EFI_STUB=y
CONFIG_X86_SYSFB=y
CONFIG_FB_SIMPLE=y
CONFIG_FRAMEBUFFER_CONSOLE=y

UEFI Runtime Variables Support (efivarfs filesystem - /sys/firmware/efi/efivars). This option is important as this is required to manipulate UEFI runtime variables using tools like efibootmgr. The configuration option below has been added in kernel 3.10 and later. 

CONFIG_EFIVAR_FS=y

GUID Partition Table (GPT) configuration option - mandatory for UEFI support 

CONFIG_EFI_PARTITION=y

EFI mixed-mode support - to boot a x86_64 kernel on a IA32 UEFI. 

CONFIG_EFI_MIXED=y
Tip: All of the above options are set accordingly in all officially supported kernels.

UEFI variables

UEFI defines variables through which an operating system can interact with the firmware. UEFI boot variables are used by the boot loader and used by the operating system only for early system start-up. UEFI runtime variables allow an operating system to manage certain settings of the firmware like the UEFI boot manager or managing the keys for UEFI Secure Boot protocol etc. You can get the list using: 

$ efivar --list

UEFI variables support in Linux kernel

Linux kernel exposes UEFI variables data to userspace via efivarfs (EFI VARiable FileSystem) interface (CONFIG_EFIVAR_FS) - mounted using efivarfs kernel module at /sys/firmware/efi/efivars - it has no maximum per-variable size limitation and supports UEFI Secure Boot variables. Introduced in kernel 3.8.

Requirements for UEFI variable support

  1. Kernel should be booted in UEFI mode via the EFI boot stub (optionally using a boot manager) or by a UEFI boot loader, not via BIOS or CSM, or Apple's Boot Camp which is also a CSM.
  2. EFI Runtime Services support should be present in the kernel (CONFIG_EFI=y, check if present with zgrep CONFIG_EFI /proc/config.gz).
  3. EFI Runtime Services in the kernel SHOULD NOT be disabled via the kernel command line, i.e. noefi kernel parameter SHOULD NOT be used.
  4. efivarfs filesystem should be mounted at /sys/firmware/efi/efivars, otherwise follow #Mount efivarfs section below.
  5. efivar should list (option -l/--list) the UEFI variables without any error.

If UEFI Variables support does not work even after the above conditions are satisfied, try the below workarounds:

  1. If listing of the UEFI variables (efivar -l) leads to efivar: error listing variables: Function not implemented and the system is booted into a realtime kernel, add efi=runtime to the kernel parameters and reboot (efivarfs functionality is disabled by default on those kernels).
  2. See #Userspace tools are unable to modify UEFI variable data for more troubleshooting steps

Mount efivarfs

If efivarfs is not automatically mounted at /sys/firmware/efi/efivars by systemd during boot, then you need to manually mount it to expose UEFI variables to userspace tools like efibootmgr: 

# mount -t efivarfs efivarfs /sys/firmware/efi/efivars
Note: The above command should be run both outside (i.e. before) and inside the chroot, if any.

See efivarfs.html for kernel documentation.

Userspace tools

There are few tools that can access/modify the UEFI variables, namely

  • efivar — Library and Tool to manipulate UEFI variables (used by efibootmgr)
https://github.com/rhboot/efivar || efivar
  • efibootmgr — Tool to manipulate UEFI Firmware Boot Manager Settings
https://github.com/rhboot/efibootmgr || efibootmgr
  • uefivars — Dumps list of UEFI variables with some additional PCI related info (uses efibootmgr code internally)
https://github.com/fpmurphy/Various/tree/master/uefivars-2.0 || uefivars-gitAUR
  • efitools — Tools for manipulating UEFI secure boot platforms
https://git.kernel.org/pub/scm/linux/kernel/git/jejb/efitools.git || efitools
  • Ubuntu's Firmware Test Suite — Test suite that performs sanity checks on Intel/AMD PC firmware
https://wiki.ubuntu.com/FirmwareTestSuite/ || fwts-gitAUR

efibootmgr

You will have to install the efibootmgr package.

Note:
  • If efibootmgr does not work on your system, you can reboot into #UEFI Shell and use bcfg to create a boot entry for the bootloader.
  • If you are unable to use efibootmgr, some UEFI firmwares allow users to directly manage UEFI boot entries from within its boot-time interface. For example, some firmwares have an "Add New Boot Option" choice which enables you to select a local EFI system partition and manually enter the EFI application location e.g. \EFI\refind\refind_x64.efi.
  • The below commands use rEFInd boot manager as example.

To add a new boot option using efibootmgr, you need to know three things:

  1. The disk containing the EFI system partition (ESP). E.g.: /dev/sda, /dev/nvme0n1.
  2. The partition number of the ESP on that disk. The Y in /dev/sdaY or /dev/nvme0n1pY.
  3. The path to the EFI application (relative to the root of the ESP)

For example, if you want to add a boot option for /efi/EFI/refind/refind_x64.efi where /efi is the mount point of the ESP, run 

$ findmnt /efi
TARGET SOURCE    FSTYPE OPTIONS
/efi   /dev/sda1 vfat   rw,flush,tz=UTC

In this example, findmnt(8) indicates that the ESP is on disk /dev/sda and has partition number 1. The path to the EFI application relative to the root of the ESP is /EFI/refind/refind_x64.efi. So you would create the boot entry as follows: 

# efibootmgr --create --disk /dev/sda --part 1 --loader '\EFI\refind\refind_x64.efi' --label 'rEFInd Boot Manager' --unicode

Get an overview of all boot entries: 

# efibootmgr --unicode

To set the boot order: 

# efibootmgr --bootorder XXXX,XXXX --unicode

Where XXXX is the number that appears in the previous output of efibootmgr command.

Delete an unwanted entry: 

# efibootmgr --delete-bootnum --bootnum XXXX --unicode

See efibootmgr(8) or efibootmgr README for more info.

Note: UEFI specification uses backward slash \ as path separator but efibootmgr can automatically convert UNIX-style / path separators.

Disable UEFI variable access

Access to the UEFI can potentially cause harm beyond the running operating system level. There are dangerous UEFI exploits like LogoFAIL which allows a malicious actor to take full control over the machine. Even hardware-level bricking is possible in some cases of poor UEFI implementation [3].

So, as the UEFI variables access is not required for daily system usage, you may want to disable it, to avoid potential security breaches or accidental harm.

Possible solutions are:

  • Mount efivars in read-only mode using fstab. For example: 
    efivarfs /sys/firmware/efi/efivars efivarfs ro,nosuid,nodev,noexec 0 0
  • Use the noefi kernel parameter to completely disable OS access to UEFI.
Note: UEFI userspace tools cannot be used with a such setup, so perform the all necessary configurations before. Also UEFI-related commands (e.g. systemctl reboot --firmware-setup) will not work either.

UEFI Shell

The UEFI Shell is a shell/terminal for the firmware which allows launching EFI applications which include UEFI bootloaders. Apart from that, the shell can also be used to obtain various other information about the system or the firmware like memory map (memmap), modifying boot manager variables (bcfg), running partitioning programs (diskpart), loading UEFI drivers, editing text files (edit), hexedit etc.

Obtaining UEFI Shell

You can obtain a BSD licensed UEFI Shell from the TianoCore EDK2 project:

Shell v2 works best in UEFI 2.3+ systems and is recommended over Shell v1 in those systems. Shell v1 should work in all UEFI systems irrespective of the spec. version the firmware follows. More information at ShellPkg and the EDK2 mailing list thread—Inclusion of UEFI shell in Linux distro iso.

Launching UEFI Shell

Few Asus and other AMI Aptio x64 UEFI firmware based motherboards (from Sandy Bridge onwards) provide an option called Launch EFI Shell from filesystem device. For those motherboards, copy the x64 UEFI Shell to the root of your EFI system partition, named as shellx64.efi.

Tip:
  • The Arch Linux installation medium has shellx64.efi at the root of the volume.
  • rEFInd and systemd-boot will automatically add a boot menu entry for the UEFI shell if shellx64.efi is in the root of the EFI system partition.

Systems with Phoenix SecureCore Tiano UEFI firmware is known to have embedded UEFI Shell which can be launched using either F6, F11 or F12 key.

Note: If you are unable to launch UEFI Shell from the firmware directly using any of the above mentioned methods, create a FAT32 USB pen drive with the EFI binary copied as /USB_drive_mointpoint/EFI/BOOT/BOOTx64.EFI. This USB should come up in the firmware boot menu. Launching this option will launch the UEFI Shell for you.

Important UEFI Shell commands

UEFI Shell commands usually support -b option which makes output pause after each page. Run help -b to list available internal commands. Available commands are either built into the shell or discrete EFI applications.

For more info see Intel Scripting Guide 2008[dead link 2023-07-30 ⓘ] and Intel "Course" 2011[dead link 2023-07-30 ⓘ].

bcfg

bcfg modifies the UEFI NVRAM entries which allows the user to change the boot entries or driver options. This command is described in detail in page 96 (Section 5.3) of the UEFI Shell Specification 2.2 document.

Note:
  • Try bcfg only if efibootmgr fails to create working boot entries on your system.
  • UEFI Shell v1 official binary does not support bcfg command. See #Obtaining UEFI Shell for a modified UEFI Shell v2 binary which may work in UEFI pre-2.3 firmwares.

To dump a list of current boot entries: 

Shell> bcfg boot dump -v

To add a boot menu entry for rEFInd (for example) as 4th (numbering starts from zero) option in the boot menu: 

Shell> bcfg boot add 3 FS0:\EFI\refind\refind_x64.efi "rEFInd Boot Manager"

where FS0: is the mapping corresponding to the EFI system partition and FS0:\EFI\refind\refind_x64.efi is the file to be launched.

To add an entry to boot directly into your system without a boot loader, see EFI boot stub#bcfg.

To remove the 4th boot option: 

Shell> bcfg boot rm 3

To move the boot option #3 to #0 (i.e. 1st or the default entry in the UEFI Boot menu): 

Shell> bcfg boot mv 3 0

For bcfg help text: 

Shell> help bcfg -v -b

or: 

Shell> bcfg -? -v -b

map

map displays a list of device mappings i.e. the names of available file systems (FS0) and storage devices (blk0).

Before running file system commands such as cd or ls, you need to change the shell to the appropriate file system by typing its name: 

Shell> FS0:
FS0:\> cd EFI/

edit

edit provides a basic text editor with an interface similar to nano, but slightly less functional. It handles UTF-8 encoding and takes care or LF vs CRLF line endings.

For example, to edit rEFInd's refind.conf in the EFI system partition (FS0: in the firmware), 

Shell> edit FS0:\EFI\refind\refind.conf

Press Ctrl+e for help.

UEFI drivers

This article or section needs expansion.

Reason: Explain what are and how to use UEFI drivers. Add automatic UEFI driver loading setup with efibootmgr's -r/--driver option. (Discuss in Talk:Unified Extensible Firmware Interface)

UEFI drivers are pieces of software that support some functionality. For example, access to NTFS formatted partitions is usually not possible from a UEFI shell. The efifs package has drivers that support reading many more file systems from within an EFI shell. A usage example is to copy such driver to a partition that can be accessed from an UEFI shell. Then, from the UEFI shell, issuing commands such as: 

Shell> load ntfs_x64.efi
Shell> map -r

After the map command has been executed, the user should be able to access NTFS formatted partitions from within a UEFI shell.

Tip:
  • systemd-boot automatically loads UEFI drivers from esp/EFI/systemd/drivers/.
  • rEFInd automatically loads UEFI drivers from the drivers and drivers_x64 subdirectories of its own installation directory on the ESP. E.g. esp/EFI/refind/drivers_x64/. It can be configured to scan additional directories.

UEFI bootable media

Create UEFI bootable USB from ISO

Follow USB flash installation medium#Using the ISO as is (BIOS and UEFI).

Remove UEFI boot support from optical media

Note:
  • This section mentions removing UEFI boot support from a CD/DVD only (Optical Media booting via EL Torito), not from a USB flash drive.
  • In order to hide the UEFI equipment on USB stick, use a partition editor after having copied the ISO to the flash drive. Remove the partition of type EF. Do not accept offers to convert to GPT.

Most of the 32-bit EFI Macs and some 64-bit EFI Macs refuse to boot from a UEFI(X64)+BIOS bootable CD/DVD. If one wishes to proceed with the installation using optical media, it might be necessary to remove UEFI support first.

Extract the ISO skipping the UEFI-specific directories: 

$ mkdir extracted_iso
$ bsdtar -x --exclude=EFI/ --exclude=loader/ -f archlinux-version-x86_64.iso -C extracted_iso

Then rebuild the ISO, excluding the UEFI optical media booting support, using xorriso(1) from libisoburn. Be sure to set the correct volume label, e.g. ARCH_202103; it can be acquired using file(1) on the original ISO. 

$ xorriso -as mkisofs \
    -iso-level 3 \
    -full-iso9660-filenames \
    -joliet \
    -joliet-long \
    -rational-rock \
    -volid "ARCH_YYYYMM" \
    -appid "Arch Linux Live/Rescue CD" \
    -publisher "Arch Linux <https://archlinux.org>" \
    -preparer "prepared by $USER" \
    -eltorito-boot syslinux/isolinux.bin \
    -eltorito-catalog syslinux/boot.cat \
    -no-emul-boot -boot-load-size 4 -boot-info-table \
    -isohybrid-mbr "extracted_iso/syslinux/isohdpfx.bin" \
    -output archlinux-version-x86_64-noUEFI.iso extracted_iso/

Burn archlinux-version-x86_64-noUEFI.iso to optical media and proceed with installation normally.

Testing UEFI in systems without native support

OVMF for virtual machines

OVMF is a TianoCore project to enable UEFI support for Virtual Machines. OVMF contains a sample UEFI firmware and a separate non-volatile variable store for QEMU.

You can install edk2-ovmf from the extra repository.

It is advised to make a local copy of the non-volatile variable store for your virtual machine: 

$ cp /usr/share/edk2/x64/OVMF_VARS.4m.fd my_OVMF_VARS.4m.fd

To use the OVMF firmware and this variable store, add following to your QEMU command: 

-drive if=pflash,format=raw,readonly,file=/usr/share/edk2/x64/OVMF_CODE.4m.fd \
-drive if=pflash,format=raw,file=my_OVMF_VARS.4m.fd

For example: 

$ qemu-system-x86_64 -enable-kvm -m 1G -drive if=pflash,format=raw,readonly,file=/usr/share/edk2/x64/OVMF_CODE.4m.fd -drive if=pflash,format=raw,file=my_OVMF_VARS.4m.fd …

DUET for BIOS only systems

DUET was a TianoCore project that enabled chainloading a full UEFI environment from a BIOS system, in a way similar to BIOS operating system booting. This method is being discussed extensively. Pre-build DUET images can be downloaded from one of the repos[dead link 2023-04-07 ⓘ]. Read specific instructions[dead link 2023-04-07 ⓘ] for setting up DUET. However, as of November 2018, the DUET code has been removed from TianoCore git repository.

You can also try Clover which provides modified DUET images that may contain some system specific fixes and is more frequently updated compared to the gitlab repos.

Troubleshooting

Boot back to Arch Linux when stuck with Windows

To boot back into Arch Linux when you are stuck with Windows, reach Advanced startup in Windows by the Windows PowerShell command shutdown /r /o, or via Settings > Update & Security > Recovery > Advanced startup and select Restart now. When you have reached the Advanced startup menu, choose Use a device, which actually contains your UEFI boot options (not limited to USB or CD, but can also boot operating system in hard drive), and choose "Arch Linux".

Enter firmware setup without function keys

On some laptops, like Lenovo XiaoXin 15are 2020, using keys like F2 or F12 does not do anything. This can possibly be fixed by returning laptops to OEM to repair mainboard information, but sometimes this is not possible or not desired. There are however other means to enter firmware setup:

Userspace tools are unable to modify UEFI variable data

If any userspace tool is unable to modify UEFI variable data, check for existence of /sys/firmware/efi/efivars/dump-* files. If they exist, delete them, reboot and retry again. If the above step does not fix the issue, try booting with efi_no_storage_paranoia kernel parameter to disable kernel UEFI variable storage space check that may prevent writing/modification of UEFI variables.

Warning: efi_no_storage_paranoia should only be used when needed and should not be left as a normal boot option. The effect of this kernel command line parameter turns off a safeguard that was put in place to help avoid the bricking of machines when the NVRAM gets too full. See FS#34641 for more information.

Cannot create a new boot entry with efibootmgr

Some kernel and efibootmgr version combinations might refuse to create new boot entries. This could be due to lack of free space in the NVRAM. You can try the solution at #Userspace tools are unable to modify UEFI variable data.

You can also try to downgrade your efibootmgr install to version 0.11.0. This version works with Linux version 4.0.6. See the bug discussion FS#34641, in particular the closing comment, for more information.

Windows changes boot order

If you dual boot with Windows and your motherboard just boots Windows immediately instead of your chosen EFI application, there are several possible causes and workarounds.

  • Ensure Fast Startup is disabled in your Windows power options
  • Ensure Secure Boot is disabled in your firmware (if you are not using a signed boot loader)
  • Ensure your UEFI boot order does not have Windows Boot Manager set first e.g. using efibootmgr and what you see in the configuration tool of the UEFI. Some motherboards override by default any settings set with efibootmgr by Windows if it detects it. This is confirmed in a Packard Bell laptop.
  • If your motherboard is booting the default boot path (\EFI\BOOT\BOOTx64.EFI), this file may have been overwritten with the Windows boot loader. Try setting the correct boot path e.g. using efibootmgr.
  • If the previous steps do not work, you can tell the Windows boot loader to run a different EFI application. From a Windows administrator command prompt bcdedit /set "{bootmgr}" path "\EFI\path\to\app.efi"
  • Alternatively, deactivate the Windows Boot Manager by running efibootmgr -A -b bootnumber as root. Replace bootnumber with the actual Windows Boot Manager boot number; you can see it by running efibootmgr with no options.
  • Alternatively, you can set a startup script in Windows that ensures that the boot order is set correctly every time you boot Windows.
    1. Open a command prompt with administrator privileges. Run bcdedit /enum firmware and find your desired boot entry.
    2. Copy the identifier, including the brackets, e.g. {31d0d5f4-22ad-11e5-b30b-806e6f6e6963}
    3. Create a batch file with the command bcdedit /set "{fwbootmgr}" DEFAULT "{copied-boot-identifier}"
    4. Open gpedit.msc and under Local Computer Policy > Computer Configuration > Windows Settings > Scripts (Startup/Shutdown), choose Startup
    5. Under the Scripts tab, choose the Add button, and select your batch file
Note: Windows 10 Home does not officially include gpedit.msc, although there are unsupported workarounds to install it manually.
  • Alternatively, Task Scheduler can be used to run a startup script in Windows:
    1. Follow steps 1-3 above to create the batch file.
    2. Run taskschd.msc, then choose Create Task... from the Action menu.
    3. On the General tab:
      Enter any suitable Name and Description.
      Ensure the user account selected is an "Administrator", not a "Standard User".
      Select "Run whether user is logged in or not".
      Select "Run with highest privileges".
    4. On the Triggers tab, choose "At startup" from the menu, then click OK.
    5. On the Actions tab, click New..., then Browse..., and locate the batch file from step 1.
    6. On the Conditions tab, untick the Power options so the script runs when on battery power (for laptops).
    7. Click OK, and enter the password of the user account selected in step 4 when prompted.

USB media gets struck with black screen

This issue can occur due to KMS issue. Try disabling KMS while booting the USB.

UEFI boot loader does not show up in firmware menu

Some firmware do not support custom boot entries. They will instead only boot from hardcoded boot entries.

A typical workaround is to not rely on boot entries in the NVRAM and install the boot loader to one of the common fallback paths on the EFI system partition.

The following sections describe the fallback paths.

Default boot path for removable drives

The UEFI specification defines default file paths for EFI binaries for booting from removable media. The relevant ones are:

  • esp/EFI/BOOT/BOOTx64.EFI for x64 UEFI
  • esp/EFI/BOOT/BOOTIA32.EFI for IA32 UEFI.

While the specification defines these for removable drives only, most firmware support booting these from any drive.

See the appropriate boot loader article on how to install or migrate the boot loader to the default/fallback boot path.

Microsoft Windows boot loader location

On certain UEFI motherboards like some boards with an Intel Z77 chipset, adding entries with efibootmgr or bcfg from the UEFI Shell will not work because they do not show up on the boot menu list after being added to NVRAM.

This issue is caused because the motherboards can only load Microsoft Windows. To solve this you have to place the .efi file in the location that Windows uses.

Copy the BOOTx64.EFI file from the Arch Linux installation medium (FSO:) to the Microsoft directory your ESP partition on your hard drive (FS1:). Do this by booting into EFI shell and typing: 

Shell> mkdir FS1:\EFI\Microsoft
Shell> mkdir FS1:\EFI\Microsoft\Boot
Shell> cp FS0:\EFI\BOOT\BOOTx64.EFI FS1:\EFI\Microsoft\Boot\bootmgfw.efi

After reboot, any entries added to NVRAM should show up in the boot menu.

Boot entries created with efibootmgr fail to show up in UEFI

efibootmgr can fail to detect EDD 3.0 and as a result create unusable boot entries in NVRAM. See efibootmgr issue 86 for the details.

To work around this, when creating boot entries manually, add the -e 3 option to the efibootmgr command. E.g. 

# efibootmgr --create --disk /dev/sda --part 1 --loader '\EFI\refind\refind_x64.efi' --label 'rEFInd Boot Manager' --unicode -e 3

To fix boot loader installers, like grub-install and refind-install, create a wrapper script /usr/local/bin/efibootmgr and make it executable: 

/usr/local/bin/efibootmgr
#!/bin/sh

exec /usr/bin/efibootmgr -e 3 "$@"

UEFI boot entry disappears after removing its referenced drive

Some firmware will remove boot entries referencing drives that are not present during boot. This could be an issue when frequently detaching/attaching drives or when booting from a removable drive.

The solution is to install the boot loader to the default/fallback boot path.

Boot entries are randomly removed

Some motherboards may remove boot entries due to lack of free space in the NVRAM instead of giving an error at creation. To prevent this from occurring, reduce the amount of boot entries being added by minimizing your entry creation process, as well as reducing the amount of automatic drive boot entries by the Compatibility Support Module (CSM) by disabling it from your UEFI settings. See BBS#1608838.

Another reason why boot entries might have been removed is the fact that UEFI specification allows OEMs to do "NVRAM maintenance" during boot process. Those manufacturers do it simply: they just look up for EFI applications in predefined, hardcoded paths on the device. If they fail to find any, they conclude there is no operating system on the device and wipe all boot entries from NVRAM associated with it, because they assume the NVRAM contains some corrupted or outdated data. If you do not plan to install Windows and still want to load the Linux kernel directly from the firmware, one possible workaround is to create an empty file esp/EFI/BOOT/BOOTx64.EFI: 

# mkdir -p esp/EFI/BOOT 
# touch esp/EFI/BOOT/BOOTx64.EFI

And restore the deleted boot entry. Now after reboot the motherboard will see the "Fake OS" and should not wipe other boot entries from NVRAM. You can change the fake operating system loader with an actual EFI application if you want, of course, as long as you keep the standard fallback name.

See also