How many EFI System Partitions (ESP) can a computer have?

Question

I'm trying to set up dual/multiboot on an UEFI laptop that came with Windows 8 installed. I'd like to operate with Secure Boot enabled. I can install/configure OS'es with SecureBoot disabled (but I won't operate in CSM mode). I'm OK with blowing out Windows 8, but eventually the laptop will need Windows 8 Pro (x64) installed to support my Windows Phone development gear.

I've read through Microsoft's documentation on UEFI and partitioning at Windows and GPT FAQ. I'm not clear on how many EFI System Partitions (ESP) can be present on a disk. Since the UEFI can authorize access to a particular partition, I think the following holds:

• Microsoft's platform key (PK) is loaded in UEFI
• MS PK allows to access to Microsoft partitions
• MS uses 4 partitions: ESP, MSR, Data, Recovery
• Boot to MS when the Boot Option is selected (enforced by UEFI)

Above, ESP is UEFI System Partition; MSR is Microsoft System Reserved for additional non-preboot files and OEM files; Data is for customary OS files loaded by the loader; and Recovery is just value added OS stuff.

If I add a Linux operating system's platform key to the Platform Key (PK) database, then I believe I would need (at minimum):

• Another ESP partition for booting/loading the Linux OS
• Another Data partition for the customary Linux OS files

The additional ESP would be required because UEFI will need boot/loader files signed under the PK for the particular Boot Option; and UEFI will not allow access to Microsoft's partitions when booting Linux's OS.

How many EFI System Partitions (ESP) can a computer have? Is multi-ESP correct?

Solution

You're operating under the misapprehension that PKs are tied to ESPs; they aren't. The Secure Boot cryptographic features require that individual boot loader files be signed, but those files are stored on ordinary FAT filesystems that are themselves not signed, encrypted, or otherwise cryptographically interesting. A signed boot loader file can be moved from one partition to another and continue to work just fine, at least from a Secure Boot perspective. (Moving such a file may cause it to fail because it's been separated from critical configuration files or the like, of course, but that's another matter.)

To more directly answer the question, the EFI specification imposes no limit on the number of ESPs that may be present on a computer or on a hard disk; you could have dozens of them if you wanted to, and that would be fine from the EFI's perspective. Unfortunately, Microsoft is not so flexible; Windows officially supports just one ESP per disk (maybe per computer; I'm a bit foggy on that detail). I don't know about Windows 8, but the Windows 7 installer will flake out if it sees more than one ESP on a disk; the installation will proceed part of the way and then fail. (At least, that's what it's done in my tests.) That said, if you create a second ESP after installing Windows, Windows will continue to boot and operate correctly, at least as far as I've seen. (I can't promise that it won't misbehave if you use some particular feature, though.)

Overall, then, in a multi-boot environment, I recommend restricting yourself to one ESP. I also recommend making it rather large -- 550MiB is my usual recommendation, for assorted technical reasons having to do with rare bugs and FAT sizes. That said, if you've got an existing installation with a smaller ESP, it's probably fine to just stick with it. In either case, Linux and Windows can share a single ESP just fine. I do, however, recommend backing it up early and often -- definitely back it up before installing a new OS. Because the ESP holds your boot loaders, an accidental erasure of it will render your computer unbootable.

Comments

[Валерий Заподовников]

I tried two by copying the last, it still works, then deleted the last active one and rebooted it still works. The partition to boot from whether it FAT32 or NTFS is specified in nvram.

[jww]

"the EFI specification imposes no limit on the number of ESPs that may be present on a computer or on a hard disk". Perfect, thanks.

[jww]

"Microsoft is not so flexible; Windows officially supports just one ESP per disk". Microsoft did not state this, but I thought it was the case due to their shady language. The same guys are probably writing "the NSA does not have direct access to our customer's data".

[Rod Smith]

Regarding the quote that "access to a partition is controlled by the system firmware," you're over-interpreting. That doesn't refer to cryptographic controls, but to the fact that the EFI provides drivers to give EFI programs access to partitions. Microsoft does say that it supports just one ESP. For instance, here: "Q: Can there be two ESPs on a single disk? A: Such a configuration should not be created and is not supported in Windows."

[opatut]

Windows 10 failed to install while I had a two disks with an ESP each. When I unplugged the other one, the installer was able to continue without error, reusing the existing ESP on the only disk I left plugged in (which included the target window root partition as well).

[Thorsten Schöning]

the EFI specification imposes no limit on the number of ESPs that may be present on a computer or on a hard disk Other people see that differently: news.ycombinator.com/item?id=16261695 news.ycombinator.com/item?id=16262177 One can have lots of FAT32 partitions, but not each of those is necessarily an ESP.

[Rod Smith]

@ThorstenSchöning, the page you reference does not address the number of ESPs that are permitted on a computer or hard disk, just the distinction between an ESP and non-ESP FAT partitions and how the EFI discovers and uses partitions generally. What's more, that post is somebody's interpretation of the EFI specification (as is my answer here). If you wish to challenge my claim that the EFI specification does not limit the number of ESPs, please reference the part of the EFI specification that does so. If such a limit is in the EFI specification, quoting it is an easy refutation of my claim.

[Thorsten Schöning]

@RodSmith Both links are of course explicit about how many ESP are allowed: No you really can't. There can only be one ESP and that's in the spec. and The parts of the spec you quoted are not referring explicitly to an ESP, but just "any recognized partition" which also includes non-ESP FAT32 partitions. So you are missing the point: It's your claim that the number is NOT limited, so you need to prove and didn't. My links provide good arguments that it's limited, so it's claim vs. claim, while my quoted ones are actually based on arguments.

[Rod Smith]

No, @ThorstenSchöning, the link you provided is not the EFI spec and does not explicitly say that the number of ESPs is limited. The EFI spec itself, the last time I checked, did not say anything explicit about the number of ESPs permitted on a disk or on a computer. Your claim that I need to prove this is backwards. My claim is that this information is not present in the document, which is impossible to prove except by quoting the whole document. Your claim, OTOH, that there is an explicit limit in the EFI spec is easily demonstrated, if true; just quote or reference the passage.

[Thorsten Schöning]

@RodSmith I never claimed that I quoted the spec. You didn't quote that as well. I confronted you with other opinions and expected you to e.g. quote sentences like the following: This will allow drivers and applications, including OS loaders, to easily search for handles that represent EFI System Partitions or vendor specific partition types. 13.3.3 Number and Location of System Partitions UEFI does not impose a restriction on the number or location of System Partitions that can exist on a system. uefi.org/sites/default/files/resources/UEFI_Spec_2_8_final.p‌​df

[Thorsten Schöning]

Afterwards I would have quoted sentences which obviously focus on a single ESP: System partition. The System partition defines a partition and file system that are designed to allow safe sharing[...]The ability to include a separate, sharable system partition presents an opportunity[...] The spec uses phrases like "the system partition" at many other places as well. And one argument from my links again: Further, UEFI implementations may allow the use of conforming FAT partitions which do not use the ESP GUID. So in practice things might simply be mixed.

[Rod Smith]

@ThorstenSchöning, the 13.3.3 section you yourself quote is quite explicit that the EFI spec does not impose a limit on the number of ESPs on a computer. The use of the word "the" preceding "System partition" is extraordinarily weak evidence to the contrary; you have to read a lot into the use of the word "the" to draw an inference contradicting what is explicitly stated elsewhere. The explicit statement easily trumps such an inference. References to multiple "conforming FAT partitions" are irrelevant to the discussion.