How to determine which was the boot device ?

[pietinger]

Is there a way to find out if the kernel was bootet from my ssd or from an usb stick (if both kernels are identical) ?

Background: I have a signed monolithic stub kernel which will be loaded via secure boot. Because I wanted to test something dangerous with my running kernel, I did a copy of my kernel to a stick before. I did all regular (fat32, mark as esp, ...) except one typo: The name of the kernel was "bootx46.efi" on the stick and not as needed "bootx64.efi" ... so, my UEFI didnt find anything to boot on this stick ... and booted my regular kernel from ssd (as next in boot list). My rescue stick was completly useless ...

Lucky me, nothing happened AND I did a little change to the built-in boot parameter before (and compiled) and after some hours I recognised there was the "old" command line in dmesg (from the ssd kernel), telling me I bootet from ssd and not from the stick (yes, UEFI was so fast I did not noticed it).

I did a diff between both message-logs and find nothing to determine from where I bootet. Maybe somewhere in /sys or /proc ?

Thanks in advance,
Peter

[Hu]

In the general case, your kernel does not know from where it was booted. It finds itself running, in memory, with a command line that directs it how to proceed. It may have been put there by firmware, by another Linux kernel (kexec), by a bootloader, etc. Some bootloaders will pass extra data to the kernel, via the command line, which might let you determine where the kernel image was found.

[figueroa]

Code: Select all

$ dmesg | head -3
[    0.000000] microcode: microcode updated early to revision 0x2f, date = 2019-02-17
[    0.000000] Linux version 4.9.240-gentoo (root@bethel) (gcc version 9.3.0 (Gentoo 9.3.0-r1 p3) ) #1 SMP Mon Oct 19 13:01:46 EDT 2020
[    0.000000] Command line: BOOT_IMAGE=/boot/kernel-4.9.240-gentoo root=/dev/sda1 ro

Maybe not definitive, but it's a pretty good hint.

[pietinger]

Code: Select all

$ dmesg | head -3
[    0.000000] microcode: microcode updated early to revision 0x2f, date = 2019-02-17
[    0.000000] Linux version 4.9.240-gentoo (root@bethel) (gcc version 9.3.0 (Gentoo 9.3.0-r1 p3) ) #1 SMP Mon Oct 19 13:01:46 EDT 2020
[    0.000000] Command line: BOOT_IMAGE=/boot/kernel-4.9.240-gentoo root=/dev/sda1 ro

Maybe not definitive, but it's a pretty good hint.

Yes, thank you, but this is empty when you boot a stub kernel without a boot manager.

I have later in the message log a second entry, like this:

Code: Select all

Oct 26 13:42:07 localhost kernel: [    0.026571] Kernel command line: root=PARTUUID=99beb5b2-b529-40fb-b0bc-3250a5237491 ro loglevel=8 lsm.debug

Yes with different parms I was able to recognize that it was bootet from ssd (bevause I hadnt "lsm.debug")

Thanks to you and Hu for your help.