Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[SOLVED] I'm Going Insane Trying to Get UEFI Boot Working
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Installing Gentoo
View previous topic :: View next topic  
Author Message
fandingo
n00b
n00b


Joined: 27 Aug 2023
Posts: 12

PostPosted: Tue Sep 12, 2023 1:19 am    Post subject: [SOLVED] I'm Going Insane Trying to Get UEFI Boot Working Reply with quote

I'm a long-time Linux user, but new to Gentoo. I've been fighting this issue on and off for a couple of weeks, and I'm at my wits' end. I can't get UEFI booting to work no matter what, and I need a lot of help.

Ultimately, I want to build an Unified Kernel Image, but I'm struggling just to boot via EFI. I'm using systemd-boot, and that seems to work fine. The EFI firmware detects it, systemd-boot shows the boot menu, and I can see my Gentoo entry. However, no matter how I build the system, it's just a blinking cursor. No kernel panic, no output at all. It's so frustrating.


########
# 1. Code #
########

The complete install scripts are available HERE.

Code:

├── gentoo
│   ├── binaries
│   │   └── stage3.tar.xz
│   ├── etc
│   │   ├── dracut.conf
│   │   ├── dracut.conf.d
│   │   │   └── crypt-ssh.conf
│   │   ├── locale.gen
│   │   └── portage
│   │       ├── #make.conf#
│   │       ├── make.conf
│   │       ├── package.accept_keywords
│   │       │   └── dracut-crypt-ssh
│   │       └── package.use
│   │           ├── cryptsetup
│   │           ├── dropbear
│   │           └── systemd
│   ├── kconfig
│   ├── kconfig____testing___
│   ├── scripts
│   │   ├── bind.sh
│   │   ├── stage1.sh
│   │   └── stage2.sh
│   └── secrets
│       ├── initrd_ssh_key
│       ├── initrd_ssh_key.pub
│       ├── pw
│       ├── ssh_host_ecdsa_key
│       ├── ssh_host_ecdsa_key.pub
│       ├── ssh_host_ed25519_key
│       ├── ssh_host_ed25519_key.pub
│       ├── ssh_host_rsa_key
│       └── ssh_host_rsa_key.pub
└── gentoo.xml


Originally, I had rootfs encrypted with dm-crypt/LUKS to be unlocked with the dropbear SSH server. However, I've simplified those components out for the time being.

To follow along at home, you will need to do the following:


  • Edit gentoo.xml for memory (16GiB is set!), disk locations (qemu-img create <file> size), network, and ids (uuid/mac/etc.).
  • virsh define gentoo.xml && virsh start gentoo && virsh console gentoo
  • /etc/init.d/sshd start; passwd; ip a
  • ctrl+]
  • scp -r <CODE_DIR> && ssh root@IP
  • stage1.sh && stage2.sh




############
# 2. Objectives #
############

I'm trying to build out a home lab that will consist of a few physical systems, some libvirt VMs, and a k8s cluster on top. I'm currently trying to build a libvirt VM to test the functionality of what all the systems in the lab will require. The most significant requirements at this stage are:


  • EFI Boot
  • systemd
  • For physical systems with dm-crypt/LUKS filesystems, allow SSH connections in the initramfs for unlocking.
  • Minimize kernel, initramfs, and rootfs size.


I come from a Fedora/RH background, and when exploring the SSH unlock problem, sys-kernel/dracut-crypt-ssh is very enticing. I have previous experience with dracut, and it seems like the sensible solution.



###############
# 3. Failed Attempts #
###############


Well, I started with sys-kernel/gentoo-sources for the first few dozen times. make menuconfig tempts even Knuth to say =n [/b]to practically everything. I wasted so much time trying different kconfigs, thinking I cut too much. I desperately tried make allyesconfig more than once. (Fun fact: that's when /dev/vdb was added as swap and -j4 needed an explicit invite.)

I tried a ton of kconfigs to get this working. I always figured I didn't get the CONFIG_ options just right, and I probably didn't. So I switched out a lot for sys-kernel/gentoo-kernel-bin. It's still not working. The systemd-boot menu shows the proper Gentoo entry, but it's just a blinking cursor after selecting it.




#########
# 4. Dracut #
#########

Let's talk about dracut for a minute. First, my dracut.conf is available in the repository above. I have not found any dracut.conf settings to produce a bootable system using the EFI firmware. I want to use uefi="yes". This creates an UKI that is an EFI executable. systemd-boot should be able to boot this executable, and eventually, I should be able to rename this UKI to bootx64.efi and boot it directly without systemd-boot.

Next, I tried changing the /etc/dractu.conf to have uefi="no". This produces a separate kernel and initramfs. When booting the libvirt VM, systemd-boot loader detects that entry properly, but it's the same blinking cursor forever.

Whether I build a UKI or traditional split kernel and initramfs files, I cannot boot no matter what kconfig I try. It's so weird.

Here's my ESP tree that has a dracut build with both uefi=yes and uefi=no. Both just show a blinking cursor after selection

systemd-boot loader menu

Code:

/boot/
├── EFI
│   ├── BOOT
│   │   └── BOOTX64.EFI
│   ├── Linux
│   │   └── linux-6.1.46-gentoo-dist-Default.efi
│   └── systemd
│       └── systemd-bootx64.efi
├── gentoo
│   └── 6.1.46-gentoo-dist
│       ├── initrd
│       └── linux
└── loader
    ├── entries
    │   └── gentoo-6.1.46-gentoo-dist.conf
    ├── entries.srel
    ├── loader.conf
    └── random-seed






#################
# 5. QEMU Direct Boot #
################

Changing the dracut.conf to uefi="no" produces separate kernel and initrd images. Let's scp those out of the VM into the host OS, and let's change the domain xml. The EFI section changes to

Code:

  <os firmware="efi">
    <type arch="x86_64" machine="pc-q35-7.2">hvm</type>
    <firmware>
      <feature enabled="no" name="secure-boot"/>
    </firmware>
    <kernel>/var/scratch/virt_disks/6.1.46-gentoo-dist/linux</kernel>
    <initrd>/var/scratch/virt_disks/6.1.46-gentoo-dist/initrd</initrd>
    <boot dev="hd"/>
  </os>


It boots every time. All my wacky kconfigs boot, allyesconfig boots, etc.



===========


I'm so confused. The systemd-boot loader works, the EFI and non-EFI are always detected properly, and I can boot the dracut uefi=no files through qemu direct boot.

Any help would be greatly appreciated. Thanks!


Last edited by fandingo on Fri Oct 13, 2023 10:44 am; edited 1 time in total
Back to top
View user's profile Send private message
kimchi_sg
Advocate
Advocate


Joined: 26 Nov 2004
Posts: 2968

PostPosted: Tue Sep 12, 2023 2:22 am    Post subject: Re: I'm Going Insane Trying to Get UEFI Boot Working Reply with quote

fandingo wrote:
I'm a long-time Linux user, but new to Gentoo. I've been fighting this issue on and off for a couple of weeks, and I'm at my wits' end. I can't get UEFI booting to work no matter what, and I need a lot of help.

Ultimately, I want to build an Unified Kernel Image, but I'm struggling just to boot via EFI. I'm using systemd-boot, and that seems to work fine. The EFI firmware detects it, systemd-boot shows the boot menu, and I can see my Gentoo entry. However, no matter how I build the system, it's just a blinking cursor. No kernel panic, no output at all. It's so frustrating.


Well, fellow systemd-boot user here, all I do is:
Code:

# echo sys-apps/systemd-utils boot >> /etc/portage/package.use/01-systemd-utils
# emerge --oneshot --quiet installkernel-systemd-boot
# bootctl install


... rest of install steps omitted, proceed until installing kernel, I just do ...

Code:

# emerge gentoo-kernel
# nano /boot/loader/entries/gentoo-*.conf

change options line to
Code:

options root=LABEL=root

(replace LABEL=root with whatever your root device node or label is)

Reboot that's it
Back to top
View user's profile Send private message
fandingo
n00b
n00b


Joined: 27 Aug 2023
Posts: 12

PostPosted: Tue Sep 12, 2023 3:09 am    Post subject: Reply with quote

Thanks for the reply!

Could I ask you a few questions about your system?


1. Filesystem Structure

Code:

tree -h /boot



2. kconfig
Code:

gunzip -c /proc/config.gz



3. loader/entries
Code:

cat /boot/loader/entries/gentoo-*.conf
cat /boot/loader/loader.conf
Back to top
View user's profile Send private message
kimchi_sg
Advocate
Advocate


Joined: 26 Nov 2004
Posts: 2968

PostPosted: Tue Sep 12, 2023 3:23 am    Post subject: Reply with quote

fandingo wrote:
Thanks for the reply!

Could I ask you a few questions about your system?


1. Filesystem Structure

Code:

tree -h /boot



2. kconfig
Code:

gunzip -c /proc/config.gz



3. loader/entries
Code:

cat /boot/loader/entries/gentoo-*.conf
cat /boot/loader/loader.conf


1.
Code:

$ tree -h /boot/
[4.0K]  /boot/
├── [4.0K]  EFI
│   ├── [4.0K]  BOOT
│   │   └── [ 92K]  BOOTX64.EFI
│   ├── [4.0K]  Linux
│   └── [4.0K]  systemd
│       └── [ 92K]  systemd-bootx64.efi
├── [4.0K]  gentoo
│   └── [4.0K]  6.1.46-gentoo-dist
│       ├── [ 51M]  initrd
│       └── [ 12M]  linux
└── [4.0K]  loader
    ├── [4.0K]  entries
    │   └── [ 310]  gentoo-6.1.46-gentoo-dist.conf
    ├── [   6]  entries.srel
    ├── [  30]  loader.conf
    └── [  32]  random-seed

9 directories, 8 files


2. https://pastebin.com/AxeCDPft

3.
Code:

$ cat /boot/loader/loader.conf
#timeout 3
#console-mode keep
$ cat /boot/loader/entries/gentoo-6.1.46-gentoo-dist.conf
# Boot Loader Specification type#1 entry
# File created by /usr/lib/kernel/install.d/90-loaderentry.install (systemd 253)
title      Gentoo Linux
version    6.1.46-gentoo-dist
sort-key   gentoo
options    root=LABEL=root
linux      /gentoo/6.1.46-gentoo-dist/linux
initrd     /gentoo/6.1.46-gentoo-dist/initrd
Back to top
View user's profile Send private message
fandingo
n00b
n00b


Joined: 27 Aug 2023
Posts: 12

PostPosted: Tue Sep 12, 2023 6:55 am    Post subject: Reply with quote

Thanks for the info. I was it wouldn't look similar to what I've tried, but it seems about the same. I'll have to go through the kconfig in more detail, but it seems like my problem is with dracut.
Back to top
View user's profile Send private message
sMueggli
Guru
Guru


Joined: 03 Sep 2022
Posts: 369

PostPosted: Tue Sep 12, 2023 9:50 am    Post subject: Reply with quote

I am absolutely no expert, but looking at https://github.com/fandingo/homelab-questions/blob/main/spaceman/gentoo/kconfig I would say that your kernel is missing the "graphic" support for the virtualised stuff, e.g.

Code:
CONFIG_DRM_VMWGFX
CONFIG_DRM_QXL

and others.

Can you ping the machine when you are in the "blinking cursor" state?
Back to top
View user's profile Send private message
Viorel
Developer
Developer


Joined: 13 Feb 2012
Posts: 16

PostPosted: Tue Sep 12, 2023 12:10 pm    Post subject: Reply with quote

Do you have CONFIG_FB_EFI?
Back to top
View user's profile Send private message
De-Javu
n00b
n00b


Joined: 30 Mar 2009
Posts: 24
Location: USA

PostPosted: Fri Sep 22, 2023 11:15 am    Post subject: Reply with quote

Hi fandingo,

I've seen in your initial post you're looking to use systemd-boot. Let's get your systemd-boot working, and then we can try to get your Unified Kernel Image prepared.

You did use a systemd stage3 when setting up your system, right? 8)

gentoo-kernel and gentoo-kernel-bin are both perfectly prepared to work with systemd-boot, so let's work with an unmodified Gentoo distribution kernel. Either the kind you compile yourself or the -bin version is fine. If you've been modding the kernel, remove any mods so it's the stock Gentoo kernel.

Remove the configuration file for systemd-boot. You shouldn't need any configuration file to successfully boot into Gentoo.

First update your emerge ebuild repository with
Code:
root #emerge-webrsync


Next we will ensure the system is loaded in UEFI mode.
Code:
root #ls /sys/firmware/efi/efivars


As long as the directory exists, and there are files inside it, we are good to go.

Next, remove whatever configuration you added to /etc/dracut.conf. Mine is totally stock with no added options. It should look like this.
Code:
root #cat /etc/dracut.conf

# PUT YOUR CONFIG IN separate files
# in /etc/dracut.conf.d named "<name>.conf"
# SEE man dracut.conf(5) for options


Now we need to make sure systemd is compiled with boot support!!! Unlike what the Gentoo wiki suggests, we want to add both boot and gnuefi flags to make sure this continues working across different kernel versions. (See the systemd-boot wiki page for more info on why there are two separate use flags for different version kernels. I don't believe adding both at once causes any harm).
Code:
root #mkdir -p /etc/portage/package.use
root #echo "sys-apps/systemd boot gnuefi" >> /etc/portage/package.use/systemd
root #emerge --ask --oneshot --verbose sys-apps/systemd


Now, mount your ESP to /efi, if it is not already. Make /efi if it does not exist. Then run:
Code:
root #bootctl --esp-path=/efi install


Then let's make sure we have the latest kernel. (Add -bin if you want the precompiled kernel). It will run Dracut automatically at the end of the kernel installation if a newer version is applied.
Code:
root #emerge --ask gentoo-kernel


At this point, you should be able to reboot into a working system. If for some reason you still can't boot correctly, you may want to try removing everything inside the ESP and try the above steps a second time.

I think kimchi_sg offered good advice, but I never added anything to /(ESP)/loader/entries/gentoo-*.conf and don't think you need to if systemd-boot now works as intended. I never did, and I can boot to multiple kernel versions of Gentoo or Windows 10 without issue.

If everything does work now, you can move onto building the Unified Kernel Image, and have yourself a cookie. :D


Edit 9/23/23 - Thank you fandingo for noticing I've mistyped the name of the kernel package in my original post. I've fixed it now. Thank you! De-Javu


Last edited by De-Javu on Sat Sep 23, 2023 9:49 pm; edited 1 time in total
Back to top
View user's profile Send private message
fandingo
n00b
n00b


Joined: 27 Aug 2023
Posts: 12

PostPosted: Sat Sep 23, 2023 6:12 am    Post subject: Reply with quote

Sorry that I've been slow to respond. Thanks everyone so much for your replies. I haven't had as much time to dedicate over the past week as I'd have liked.

I read all your replies diligently, and I learned a lot. It's amazing to have such a nice community. I appreciate your answers so much.


A couple of replies are in order:


@Viorel @sMueggli,

Again, thanks a ton for the responses. I actually learned a ton reading through those config options.


I wanted to provide some follow-up information:

My use-case is not normal. I created that domain.xml specifically, so that I could use `virsh console gentoo` without using something like `virt-manager`. However, opening the guest in `virt-manager` would be View→Consoles→Serial 1, without a graphical option. Niche case, but we're not always looking at a FB through a GPU on a monitor or a something like a SPICE (ah, however the that works).


=======

@De-Javu,

Thanks for your reply. Yeah, this is close to the approach that I've been working on today to quite a bit of success.

Slight correction: gentoo-kernel, not gentoo-sources

De-Javu wrote:

Unlike what the Gentoo wiki suggests, we want to add both boot and gnuefi flags to make sure this continues working across different kernel versions. (See the systemd-boot wiki page for more info on why there are two separate use flags for different version kernels. I don't believe adding both at once causes any harm).


First, yeah, both flags work fine. Second, OpenRC users need to get a life and name their packages properly, jk hahaha. A package named `systemd-utils` being incompatible with systemd is dumb. But I guess that's how I learned USE flags aren't just about optimization...

=======


Thanks again for everyone's help. I've made so many code changes since I made this thread that I can't explain the full solution, but here's an attempt for posterity:


  • Don't go crazy. start with `gentoo-kernel`.
  • uefi, encrypted rootfs, dracut-crypt-ssh is a lot to handle on the first try.
  • Dracut output makes errors easy to miss.
  • UUIDs are often malformed.



=======



Conclusion:


I have a bootable UEFI Gentoo libvirt guest that has an encrypted rootfs, dracut-crypt-ssh unlock, and I'm ready to proceed with my lab.


Next step: dracut-crypt-ssh could use some modernization and work; that's where I'll be for a couple of weeks. Then, back to Gentoo to review and improve the documentation related to my setup. Afterwards, I'll do my lab.
Back to top
View user's profile Send private message
fandingo
n00b
n00b


Joined: 27 Aug 2023
Posts: 12

PostPosted: Fri Oct 13, 2023 10:44 am    Post subject: Reply with quote

I wanted to come back to this thread and actually explain what my problem was in case anyone comes across this later. The problem was actually really embarrassing... :cry:

dracut doesn't give good output when producing a UKI. Here are the last few lines of the dracut output:

Code:

dracut: *** Creating UEFI image file '/usr/src/linux-6.1.55-gentoo-dist/arch/x86/boot/initrd' done ***                                                                                                                                                                           [ ok ]
 * Combined UEFI kernel+initramfs executable found
 * Installing the kernel via installkernel ...


I thought it was a little odd that the output product was ".../initrd," but I figured that was just weird naming of the UKI executable... Nope! It does create a separate initrd, and duplicate kernels at /boot/vmlinuz-... and .../bzImage. However, the actual UKI is at /usr/src/linux/arch/x86/boot/uki.efi. That's what needs to be copied over to the ESP.

I was copying an initrd to my ESP and trying to execute that as an EFI executable.
Back to top
View user's profile Send private message
fmgjcoppens
n00b
n00b


Joined: 13 Feb 2024
Posts: 3
Location: Leiden / Paris / Bordeaux / Toulouse

PostPosted: Tue Feb 13, 2024 10:20 am    Post subject: Reply with quote

Hi fandingo. I'm dropping in a bit late. I was wondering if you sorted the UKI problem in the end?

I'm in a similar but slightly simpler situation. I have a fresh gentoo/openrc install and I want to generate a UKI, but without using 'systemd-boot'; I load my UKIs directly from the motherboard firmware using efibootmgr.

I seem to need 'sys-apps/systemd-utils' because dracut insists on using the systemd-stub to construct the UKI. This is not mentioned in Gentoo's UKI wiki page and I am also confused on what useflags to set on 'sys-kernel/kernelinstall' (I suppose this is the Debian one, and not the one from systemd since I am using the openrc version of the stage3 tarball), 'sys-kernel/dracut' and 'sys-apps/systemd-utils'

As far as I know systemd has the only known UKI stub implementation. Have you come across others?
Back to top
View user's profile Send private message
AndrewAmmerlaan
Developer
Developer


Joined: 25 Jun 2014
Posts: 266
Location: Nijmegen

PostPosted: Tue Feb 13, 2024 3:23 pm    Post subject: Reply with quote

fmgjcoppens wrote:
Hi fandingo. I'm dropping in a bit late. I was wondering if you sorted the UKI problem in the end?

I'm in a similar but slightly simpler situation. I have a fresh gentoo/openrc install and I want to generate a UKI, but without using 'systemd-boot'; I load my UKIs directly from the motherboard firmware using efibootmgr.

I seem to need 'sys-apps/systemd-utils' because dracut insists on using the systemd-stub to construct the UKI. This is not mentioned in Gentoo's UKI wiki page and I am also confused on what useflags to set on 'sys-kernel/kernelinstall' (I suppose this is the Debian one, and not the one from systemd since I am using the openrc version of the stage3 tarball), 'sys-kernel/dracut' and 'sys-apps/systemd-utils'

As far as I know systemd has the only known UKI stub implementation. Have you come across others?


To build UKIs (with the non-systemd installkernel), either:
- set uefi=yes in /etc/dracut.conf and enable the dracut flag on sys-kernel/installkernel, or
- enable the dracut and ukify flags on sys-kernel/installkernel

To boot these UKIs directly without a bootloader you need them to be on the EFI system partition, to accomplish this automatically enable the uki flag on installkernel as well.

There is currently no plugin to automatically register the installed UKI with your uefi firmware (via efibootmgr), this is because there is no easy and reliable way to write one plugin script that will do this automatically for all possible setups. Either create a custom /etc/kernel/postinst.d/95-efibootmgr.install plugin to register the new UKI, or consider installing systemd-boot to your ESP which you have already installed on your system anyway because the required systemd-stub and systemd-boot are toggled by the same configure option and are thus always installed together.

systemd-stub is the only available stub loader for UKIs (for now).
_________________
OS: Gentoo 6.7.3-gentoo-dist, ~amd64, 17.1/desktop/plasma/systemd/merged-usr
MB: MSI Z370-A PRO
CPU: Intel Core i9-9900KS
GPU: Intel Arc A770 16GB & Intel UHD Graphics 630
SSD: Samsung 970 EVO Plus 2 TB
RAM: Crucial Ballistix 32GB DDR4-2400
Back to top
View user's profile Send private message
fmgjcoppens
n00b
n00b


Joined: 13 Feb 2024
Posts: 3
Location: Leiden / Paris / Bordeaux / Toulouse

PostPosted: Wed Feb 14, 2024 2:37 pm    Post subject: Reply with quote

Thanks AndrewAmmerlaan,

I managed to get booting from a dracut generated UKI working using

sys-kernel/installkernel dracut uki
sys-apps/systemd-utils boot kernel-install (boot implies kernel-install)

Indeed, I use efibootmgr for adding them to the UEFI boot table. I have no use for systemd-boot at the moment, but thanks for the suggestion.

Creating a /etc/kernel/postinst.d/95-efibootmgr.install hook is a good idea, thanks. I do something similar on another distro and it works great.

No other UKI stub loaders? Interesting. Mr. Pottering must have done a good job :) I wonder if there is any interest in implementing other ones.
Back to top
View user's profile Send private message
pietinger
Moderator
Moderator


Joined: 17 Oct 2006
Posts: 4157
Location: Bavaria

PostPosted: Wed Feb 14, 2024 3:59 pm    Post subject: Reply with quote

fmgjcoppens wrote:
No other UKI stub loaders? [..]


that's not quite right ... UEFI boots a stub kernel without problems ... and you can "tinker" a UKI yourself ... which is what I do, for example:

1. it must be a stub kernel - and you have to configure it yourself
2. of course all firmware drivers and the microcode for the CPU should be included in the bzImage (CONFIG_EXTRA_FIRMWARE=)
3. just like the kernel command line (CONFIG_CMDLINE=)
4. if you need an initramfs (e.g. because you have an encrypted root partition or you use LVM) then you must also use an EMBEDDED initramfs. There are two possibilities:
4a. You have an external CPIO created by dracut and then do this:
https://wiki.gentoo.org/wiki/User:Pietinger/Tutorials/Initramfs_Overview#Special_Case:_Building_an_embedded_initramfs_with_a_CPIO_archive
4b. You make the initramfs yourself manually (I do).
5. Create an UEFI entry pointing to this kernel: https://wiki.gentoo.org/wiki/User:Pietinger/Tutorials/Boot_kernel_via_UEFI

... And because I am paranoid about security I also disabled the module support in the kernel (=> monolithic kernel), hardened it with KSPP and signed this image to be able to do SecureBoot. I also do this manually because I hate "shim" (had a security problem :lol: ) with: https://forums.gentoo.org/viewtopic-p-8492354.html#8492354
_________________
https://wiki.gentoo.org/wiki/User:Pietinger
Back to top
View user's profile Send private message
AndrewAmmerlaan
Developer
Developer


Joined: 25 Jun 2014
Posts: 266
Location: Nijmegen

PostPosted: Wed Feb 14, 2024 4:12 pm    Post subject: Reply with quote

With the risk of being pedantic about it, a kernel image with an embedded initramfs that is capable of EFI stub booting is not the same as an Unified Kernel Image. Both achieve a similar goal, namely including the initramfs/cmdline/kernel modules in the secure boot signature, but on a technical level they are different things. An UKI does require systemd-stub to do its magic, not so for a kernel image with an embedded initramfs. there the kernel loads this initramfs itself and no external stub is required.
_________________
OS: Gentoo 6.7.3-gentoo-dist, ~amd64, 17.1/desktop/plasma/systemd/merged-usr
MB: MSI Z370-A PRO
CPU: Intel Core i9-9900KS
GPU: Intel Arc A770 16GB & Intel UHD Graphics 630
SSD: Samsung 970 EVO Plus 2 TB
RAM: Crucial Ballistix 32GB DDR4-2400
Back to top
View user's profile Send private message
pietinger
Moderator
Moderator


Joined: 17 Oct 2006
Posts: 4157
Location: Bavaria

PostPosted: Wed Feb 14, 2024 4:25 pm    Post subject: Reply with quote

AndrewAmmerlaan wrote:
With the risk of being pedantic about it, [...]

No, you are not being pedantic; you have explained the difference between an "official" UKI and a UKI that I built myself many years ago (when the term UKI did not even exist) very well: For an "official" UKI you still need systemd-stub magic ... which as an OpenRC user I naturally want to avoid ... and raises the question why you still need an intermediate layer ... from a security point of view, I can only conclude that the less software a system needs, the more secure it is ... :roll:
_________________
https://wiki.gentoo.org/wiki/User:Pietinger
Back to top
View user's profile Send private message
fmgjcoppens
n00b
n00b


Joined: 13 Feb 2024
Posts: 3
Location: Leiden / Paris / Bordeaux / Toulouse

PostPosted: Wed Feb 21, 2024 10:51 am    Post subject: Reply with quote

Yes, I was indeed referring to the UKI specification of the Linux Userspace API Group (here)

But your alternative version of a UKI seems attractive as well and might in the end be more than enough for me. I don't care that much about secure booting, nor most of the other features the UKI spec is providing. My aim is simply to have as few layers as possible between switching on my computer and arriving at the login window. If I can do that with a single UEFI executable, I'm happy.

In any case, many thanks for all the advice!
Back to top
View user's profile Send private message
pietinger
Moderator
Moderator


Joined: 17 Oct 2006
Posts: 4157
Location: Bavaria

PostPosted: Wed Feb 21, 2024 5:02 pm    Post subject: Reply with quote

fmgjcoppens wrote:
In any case, many thanks for all the advice!

You are very Welcome ! :D

Have fun with Gentoo ! 8)
_________________
https://wiki.gentoo.org/wiki/User:Pietinger
Back to top
View user's profile Send private message
rogge
Tux's lil' helper
Tux's lil' helper


Joined: 13 Oct 2006
Posts: 132
Location: Erfurt

PostPosted: Wed Mar 06, 2024 1:07 am    Post subject: Reply with quote

AndrewAmmerlaan wrote:
With the risk of being pedantic about it, a kernel image with an embedded initramfs that is capable of EFI stub booting is not the same as an Unified Kernel Image. Both achieve a similar goal, namely including the initramfs/cmdline/kernel modules in the secure boot signature, but on a technical level they are different things. An UKI does require systemd-stub to do its magic, not so for a kernel image with an embedded initramfs. there the kernel loads this initramfs itself and no external stub is required.


Thanks for this helpful explanation!

Until these days there wasn't any reason to add initramfs to my system. But since I can't boot my maschine properly and I'd read the news, I had to add initramfs.
At least it is quite confusing to me, because yet I'd copy my kernel to /boot/EFI/BOOT/BOOTx64.EFI and it works. Now, with initramfs, I'd to add an extra layer for the same goal, but also with same system/user requirements as before.
To understand all the layers of the boot process the Arch Linux Wiki was really helpful.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Installing Gentoo All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum