User Tools

Site Tools


OpenWrt on UEFI based x86 systems

This information is outdated. There is no such branch, nor has the project accepted any UEFI-boot approach as of August, 2019


UEFI boot has been required for years now, boards that only support UEFI are common, and Intel has stated back in 2017 that “legacy” BIOS will no longer be supported after 2020.

To accommodate this, it's necessary for OpenWrt build system to generate UEFI bootable images.


There are pending commits related to add UEFI bootable OpenWrt under Jow staging repository.

Building UEFI bootable OpenWrt image

The commits necessary to build uefi bootable OpenWrt image are as follows.

tools: add libopt host build
add sgdisk host build
Generate EFI grub images for x86 platforms
x86: fix bios mkimage during efi image generation

To build the image, checkout jow-staging repository, i.e.

$ git remote add jow-staging
$ git fetch jow-staging
$ git checkout -b uefi-capable --track origin/master # so that you can rebase easily
$ git merge jow-staging

After merging the branch or checking out jow-staging repository, run make menuconfig.

Go to Target Images and make sure that Build EFI grub images option is checked.

Select additional packages as necessary and finally save changes and exit menuconfig.

Run make as usual to build the image.

The resulting image will be available as bin/targets/x86/64/openwrt-x86-64-uefi-gpt-ext4.img.gz, which can be written to disk after decompression.

UEFI Secure Boot

To generate signed image for use with secure boot, there is a development repository with corresponding packages feed under feature-uefi-secure-boot branch.

The repository contains changes based on Jow-staging branch to generate secure boot capable image

The related packages feed repository contains stuffs needed to sign efi binaries, i.e. gnu-efi and sbsigntool and stuffs to manipulate efi variables, i.e. efivar, efibootmgr, and efitools.

# Add the development git repository
$ git remote add devrepo
$ git fetch devrepo
$ git checkout feature-uefi-secure-boot
# Configure the corresponding package repository
$ echo 'src-git packages;feature-uefi-secure-boot' > ./feeds.conf
$ ./scripts/feeds clean
$ ./scripts/feeds update packages
$ ./scripts/feeds update -i
$ ./scripts/feeds install -a
# Now, configure the build system
# Select x86 as Target, x86_64 as Subtarget
# make sure to select 'Sign EFI executable binaries' under 'Target Images'
# UEFI related tools are available under Utilities section,
# which consist of efitools, efibootmgr, efivar, and sbsigntool
$ make menuconfig
# The certificate and key need to be generated
# to perform uefi binary signing
$ OLD_UMASK=$(umask)
$ umask 077
$ openssl req -new -x509 -sha256 \
  -days 90 -out ./db.crt \
  -subj '/CN=secure boot signing certificate' \
  -newkey rsa:2048 -nodes \
  -keyout ./db.key
$ umask $OLD_UMASK
# run make to generate UEFI secure bootable OpenWrt image
$ make

Remember to import db.crt (which may needs to be converted into DER or other format) into db UEFI variable to securely boot the resulting image.

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
docs/guide-developer/uefi-bootable-image.txt · Last modified: 2019/09/02 15:01 by jeff