Chainloading to the Qubes bootloader

[justin.h...@gmail.com]

My primary OS is Ubuntu and it's likely to stay that way (I need vagrant/virtualbox for work), but I'd like to spend some time using Qubes when I can.

In my ideal setup, my laptop would boot into Ubuntu by default, but have a grub entry to switch over to the Qubes bootloader on demand.

This setup isn't covered by https://www.qubes-os.org/doc/multiboot/ so I figured I'd give it a shot myself.

I installed Qubes, but elected not to make the install device bootable (since I want to keep Ubuntu in charge of booting). Then I found the Qubes bootloader partition at /dev/sda7 and attempted to add a chainloader entry to /etc/grub.d/40_custom like this:

menuentry "Qubes Chainloader" {
insmod chain
insmod ext2
set root=(hd0,gpt7)
chainloader /EFI/qubes/xen-4.6.1.efi
}

I can select 'Qubes Chainloader' at the grub menu, but it just flashes a message (I think it's something like "Loading xen-4.6.1.efi") for the briefest instant before dumping me back into grub. For what it's worth, I know it's at least finding the .efi file because it no longer complains that it can't.

TL/DR: what can I put in /etc/grub.d/40_custom to chainload the Qubes /boot partition at /dev/sda7?

[Micah Lee]

On 12/06/2016 12:18 PM, justin.h...@gmail.com wrote:
> TL/DR: what can I put in /etc/grub.d/40_custom to chainload the Qubes /boot partition at /dev/sda7?

It's kind of old at this point, but I wrote a blog post awhile ago about
dual-booting Ubuntu and Qubes, including the chainloading details:

https://micahflee.com/2014/04/dual-booting-qubes-and-ubuntu-with-encrypted-disks/

[justin.h...@gmail.com]

Right! I came across that and I was hoping to basically do the reverse, where the Ubuntu bootloader comes first and has an option for Qubes. Unfortunately, I couldn't get it to work.

[Micah Lee]

You could set chainloading to Ubuntu's grub as the default option in the
Qubes grub. You'll boot to Qubes grub, wait 3 seconds, boot to Ubuntu
grub, wait 3 seconds, boot to Ubuntu.

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Is /dev/sda7 your ESP? If so, remove 'set root' line. Generally take a
look at issue 794[1], long story short - xen.efi does not work when loaded
by grub using grub filesystem driver (instead of EFI filesystem
handling). Not setting 'root' variable should trigger EFI internal
filesystem handling.

[1] https://github.com/qubesos/qubes-issues/issue/794

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJYRzL5AAoJENuP0xzK19csEDkH/ijAHRGnNZg9IbQLQbxbYAs0
Xzgo/WKThdzZLKK7PXfi7+tQyHFw/DmHs5UOmIvvDSYSRxDUP/FfGEfOm7nhxOcQ
Lh+xKK/W7QCOnNERXtuXkcxHLGimYCMeen3ellAacJb8/Zg4ETTOP/O7OruAw3cr
FOPMR5YnOwGU9UX6/yt0yi27W8e88jOJYV8QSp4gsGiEtWbi7tlJqzHsl28hWu+P
PuW+wT7o3Y8bg+HsIu01d0zmavq9qI/+Smgm9kePdL6FiVq8ulpg9fI8GCYcdBdz
81+YIgzcTDraYjs0mFH62O78TSVW0F+uqnYGpZW4tHM4eN/NMfEB8hSoEa+dw+Y=
=lHPA
-----END PGP SIGNATURE-----

[justin.h...@gmail.com]

On Tuesday, December 6, 2016 at 1:52:00 PM UTC-8, Marek Marczykowski-Górecki wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> On Tue, Dec 06, 2016 at 12:18:09PM -0800, justin.h...@gmail.com wrote:
> > My primary OS is Ubuntu and it's likely to stay that way (I need vagrant/virtualbox for work), but I'd like to spend some time using Qubes when I can.
> >
> > In my ideal setup, my laptop would boot into Ubuntu by default, but have a grub entry to switch over to the Qubes bootloader on demand.
> >
> > This setup isn't covered by https://www.qubes-os.org/doc/multiboot/ so I figured I'd give it a shot myself.
> >
> > I installed Qubes, but elected not to make the install device bootable (since I want to keep Ubuntu in charge of booting). Then I found the Qubes bootloader partition at /dev/sda7 and attempted to add a chainloader entry to /etc/grub.d/40_custom like this:
> >
> > menuentry "Qubes Chainloader" {
> > insmod chain
> > insmod ext2
> > set root=(hd0,gpt7)
> > chainloader /EFI/qubes/xen-4.6.1.efi
> > }
> >
> > I can select 'Qubes Chainloader' at the grub menu, but it just flashes a message (I think it's something like "Loading xen-4.6.1.efi") for the briefest instant before dumping me back into grub. For what it's worth, I know it's at least finding the .efi file because it no longer complains that it can't.
> >
> > TL/DR: what can I put in /etc/grub.d/40_custom to chainload the Qubes /boot partition at /dev/sda7?
>
> Is /dev/sda7 your ESP? If so, remove 'set root' line.

I'm not sure it qualifies as "the" ESP (I don't know EFI very well), but /dev/sda7 holds the Qubes /boot partition. It's not the partition that boots by default; that would be /dev/sda1.

If I do remove the setroot line, how will grub know that xen.efi is on /dev/sda7?

[crane...@gmail.com]

On Tuesday, December 6, 2016 at 6:17:37 PM UTC-5, justin.h...@gmail.com wrote:
> >
> > Is /dev/sda7 your ESP? If so, remove 'set root' line.
>

> If I do remove the setroot line, how will grub know that xen.efi is on /dev/sda7?

I'm waiting for that answer as well.

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

It will not know that. I think to work with this, you need to copy/move
EFI/qubes directory into your primary EFI partition.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJYTFMZAAoJENuP0xzK19csfyEH/RGH5bu9bnb7YGz8gdzTGuZw
WFIisMOnjK9s9EyVber6XZTuo9ENbPY0picx9e/Wzhx5RfRES6z38C4aUsDcnHo2
1yAZCymxcAST/1qdRbboe4lLm+Ii76bDV9+8qBuZz4nW0kvqnMfoa0kZd2n/cIho
o98/tfAyGpvcFKFFGnM8SjuyvtlsnamA+0VydhqXT5eY4RHVFzxQRHEN1i5nJPSA
zVo3wJsUwdFrdW9UKZY6DlCKXFzAI41i8pMI29D/ELDffj55lQJZmyvWfzcjbr6P
tgAoRXToJvOu4Bxg/kMnf5Z0CEsOePz1JVwkX3/DJRDEqcAyXGNEVlSYuhxbbOY=
=+4kN
-----END PGP SIGNATURE-----

[justin....@puppet.com]

Just closing the loop here. I couldn't get Qubes to boot in the original setup, so I decided to try again from scratch and ended up finding a pretty easy solution that works well for me.

1. I installed Ubuntu 16.10 with the default partition scheme.
2. I used gparted to free up 60gb of free space at the end of the drive for Qubes.
3. I ran the Qubes installer and let it automatically manage that 60gb. I didn't change any settings in the partition screen (including bootloader).

**note** at this point, I could use my BIOS menu to boot either Ubuntu or Qubes if I wanted, so I could have stopped.

4. I went back to the Ubuntu USB key and ran Boot-Repair (https://help.ubuntu.com/community/Boot-Repair) to add entries for Qubes to grub.
5. I changed the default boot device in my BIOS back to Ubuntu's boot partition.

The result was that Ubuntu's grub menu is the default, and it includes entries for Qubes that work as expected.