I have secure boot setup using full chain of trust as described in: https://wiki.gentoo.org/wiki/Secure_Boot The kernel and modules are signed and using systemd-boot as boot loader. Initramfs is embedded into kernel using genkernel: genkernel --no-splash --zfs --no-clean --install --microcode=amd -- --integrated-initramfs all I recently migrated to this setup and the system works fine with gentoo-sources kernels 6.6.20, 6.6.21, 6.6.22. But the 6.6.23 is stuck at it seems efi stub without no progress and no kernel messages. Motherboard: TUF GAMING X670E-PLUS CPU: AMD 7950x3d 128GB ECC RAM Reproducible: Always Steps to Reproduce: 1. Install =gentoo-sources-6.6.23 2. Compile kernel using genkernel: genkernel --no-splash --zfs --no-clean --install --microcode=amd --integrated-initramfs all 3. Actual Results: System hangs with Initial EFI stub messages and hangs without any visible activity. Expected Results: System should boot into kernel and kernel messages should appear like unpacking kernel, initialization etc. Portage 3.0.61 (python 3.11.8-final-0, default/linux/amd64/23.0/desktop/plasma/systemd, gcc-13, glibc-2.38-r10, 6.6.22-gentoo-x86_64 x86_64) ================================================================= System uname: Linux-6.6.22-gentoo-x86_64-x86_64-AMD_Ryzen_9_7950X3D_16-Core_Processor-with-glibc2.38 KiB Mem: 131096628 total, 102585264 free KiB Swap: 83886076 total, 83886076 free Timestamp of repository gentoo: Thu, 28 Mar 2024 11:36:04 +0000 Head commit of repository gentoo: 98d408f8a120bd099b74b458646d4a769a085377 sh bash 5.1_p16-r6 ld GNU ld (Gentoo 2.41 p5) 2.41.0 distcc 3.4 x86_64-pc-linux-gnu [disabled] app-misc/pax-utils: 1.3.7::gentoo app-shells/bash: 5.1_p16-r6::gentoo dev-build/autoconf: 2.71-r6::gentoo dev-build/automake: 1.16.5-r2::gentoo dev-build/cmake: 3.28.3::gentoo dev-build/libtool: 2.4.7-r4::gentoo dev-build/make: 4.4.1-r1::gentoo dev-build/meson: 1.3.2::gentoo dev-java/java-config: 2.3.3-r1::gentoo dev-lang/perl: 5.38.2-r2::gentoo dev-lang/python: 3.11.8_p1::gentoo, 3.12.2_p1::gentoo dev-lang/rust: 1.75.0-r1::gentoo sys-apps/baselayout: 2.14-r2::gentoo sys-apps/sandbox: 2.38::gentoo sys-apps/systemd: 255.3-r1::gentoo sys-devel/binutils: 2.41-r5::gentoo sys-devel/binutils-config: 5.5::gentoo sys-devel/clang: 17.0.6::gentoo sys-devel/gcc: 13.2.1_p20240210::gentoo sys-devel/gcc-config: 2.11::gentoo sys-devel/llvm: 17.0.6::gentoo sys-kernel/linux-headers: 6.6-r1::gentoo (virtual/os-headers) sys-libs/glibc: 2.38-r10::gentoo Repositories: gentoo location: /usr/portage sync-openpgp-key-refresh: no sync-type: git sync-uri: git://anongit.gentoo.org/repo/sync/gentoo.git priority: -1000 volatile: True sync-git-verify-commit-signature: yes crossdev location: /usr/local/portage-crossdev masters: gentoo priority: 10 volatile: True ACCEPT_KEYWORDS="amd64" ACCEPT_LICENSE="@FREE Q3AEULA skype-eula dlj-1.1 POMPOM googleearth AdobeFlash-10.1 google-talkplugin Oracle-BCLA-JavaSE AdobeFlash-10.3 AdobeFlash-11.x NVIDIA-r2 linux-firmware MSttfEULA freedist no-source-code intel-ucode MPEG-4 unRAR linux-fw-redistributable NPSL Microsoft-vscode android" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-march=native -mtune=native -pipe -mmmx -msse -msse2 -msse3 -mssse3 -momit-leaf-frame-pointer -O2" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/config /usr/share/gnupg/qualified.txt /usr/share/maven-bin-3.9/conf" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d" CXXFLAGS="-march=native -mtune=native -pipe -mmmx -msse -msse2 -msse3 -mssse3 -momit-leaf-frame-pointer -O2 -fvisibility-inlines-hidden" DISTDIR="/var/cache/distfiles" EMERGE_DEFAULT_OPTS="--jobs 48 --load-average 32" ENV_UNSET="CARGO_HOME DBUS_SESSION_BUS_ADDRESS DISPLAY GDK_PIXBUF_MODULE_FILE GOBIN GOPATH PERL5LIB PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR XDG_STATE_HOME" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-docompress binpkg-dostrip binpkg-logs binpkg-request-signature buildpkg-live config-protect-if-modified distlocks ebuild-locks fixlafiles ipc-sandbox merge-sync multilib-strict network-sandbox news parallel-fetch pid-sandbox pkgdir-index-trusted preserve-libs protect-owned qa-unresolved-soname-deps sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="https://mirror.aarnet.edu.au/pub/gentoo/ https://mirror.clarkson.edu/gentoo/ http://mirror.reenigne.net/gentoo/ rsync://mirrors.mit.edu/gentoo-distfiles/" LANG="en_US.UTF-8" LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,-z,pack-relative-relocs" LEX="flex" LINGUAS="en ru" MAKEOPTS="-j40 -l48" PKGDIR="/var/cache/binpkgs" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git" PORTAGE_TMPDIR="/var/tmp" SHELL="/bin/bash" USE="X a52 aac aacplus acpi activefilter activities alsa amd64 amr amrenc audiofile aura bash-completion bluray bs2b bzip2 cairo cdda cdio cet cleartype crypt css cups custom-optimization dbus declarative dga dhcp dri dts dvd dvdnav dvdr eap-tls encode exif extrafilters faac ffmpeg flac flatpak frei0r g3dvl gdbm gif gimp glitz gnutls gphoto2 gpm graphite gsm gtk gui heif iconv icu id3tag imlib inotify irmc java6 jpeg jpeg2k kde kdehiddenvisibility kdepim kipi kwallet lcms libmpeg2 libnotify librtmp libsoxr libssh2 libtirpc libv4l2 loop-aes lua luajit lzma mad matroska mdns-bundled mmx mmxext mng mp3 mp4 mpeg mplayer mtp multilib musicbrainz ncurses nemesi nfs nls obex ogg openal opencore-amr openct opengl openmp optimized-qmake opus pam pango pcre pcsc-lite pdf pipewire plasma png policykit ppds pulseaudio qml qt5 quvi radius readline remoteosd rtc rtmp rtsp screencast sdl seccomp slang slp smp sndfile sound speex spell sql sqlite srt sse sse2 sse3 ssl ssse3 startup-notification stream svg systemd taglib test-rust theora tiff tpmtok truetype udev udisks unicode upnp upower usb v4l v4l2 vaapi vdpau vim-pager vim-syntax vim-with-x vorbis vpx vulkan webp widgets wifi wps wxwidgets x264 x265 xanim xcb xcomposite xft xine xml xmp xosd xrandr xv xvid xvmc zfs zlib zstd" ABI_X86="64" ADA_TARGET="gcc_12" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_anon authn_dbm authn_file authz_dbm authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir env expires ext_filter file_cache filter headers include info log_config logio mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="karbon sheets words" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="aes avx avx2 avx512f avx512dq avx512cd avx512bw avx512vl avx512vbmi f16c fma3 mmx mmxext pclmul popcnt rdrand sha sse sse2 sse3 sse4_1 sse4_2 sse4a ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock greis isync itrax mtk3301 ntrip navcom oceanserver oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 tsip tripmate tnt ublox" GRUB_PLATFORMS="efi-64" INPUT_DEVICES="evdev keyboard mouse" KERNEL="linux" L10N="en ru" LCD_DEVICES="bayrad cfontz glk hd44780 lb216 lcdm001 mtxorb text" LUA_SINGLE_TARGET="lua5-1" LUA_TARGETS="lua5-1" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php8-1" POSTGRES_TARGETS="postgres15" PYTHON_SINGLE_TARGET="python3_11" PYTHON_TARGETS="python3_11" RUBY_TARGETS="ruby31" VIDEO_CARDS="vesa fbdev intel i965 radeon radeonsi" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipp2p iface geoip fuzzy condition tarpit sysrq proto logmark ipmark dhcpmac delude chaos account" Unset: ADDR2LINE, AR, ARFLAGS, AS, ASFLAGS, CC, CCLD, CONFIG_SHELL, CPP, CPPFLAGS, CTARGET, CXX, CXXFILT, ELFEDIT, EXTRA_ECONF, F77FLAGS, FC, GCOV, GPROF, INSTALL_MASK, LC_ALL, LD, LFLAGS, LIBTOOL, MAKE, MAKEFLAGS, NM, OBJCOPY, OBJDUMP, PORTAGE_BINHOST, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, PYTHONPATH, RANLIB, READELF, RUSTFLAGS, SIZE, STRINGS, STRIP, YACC, YFLAGS ================================ $ bootctl System: Firmware: UEFI 2.90 (American Megatrends 5.26) Firmware Arch: x64 Secure Boot: enabled (user) TPM2 Support: no Measured UKI: no Boot into FW: supported Current Boot Loader: Product: systemd-boot 255 Features: ✓ Boot counting ✓ Menu timeout control ✓ One-shot menu timeout control ✓ Default entry control ✓ One-shot entry control ✓ Support for XBOOTLDR partition ✓ Support for passing random seed to OS ✓ Load drop-in drivers ✓ Support Type #1 sort-key field ✓ Support @saved pseudo-entry ✓ Support Type #1 devicetree field ✓ Enroll SecureBoot keys ✓ Retain SHIM protocols ✓ Menu can be disabled ✓ Boot loader sets ESP information ESP: /dev/disk/by-partuuid/.... File: └─/EFI/systemd/systemd-bootx64.efi Random Seed: System Token: set Exists: no Available Boot Loaders on ESP: ESP: /boot/efi (/dev/disk/by-partuuid/....) File: (can't access /boot/efi: Permission denied) Boot Loaders Listed in EFI Variables: Title: Linux Boot Manager ID: 0x0000 Status: active, boot-order Partition: /dev/disk/by-partuuid/... File: └─/EFI/systemd/systemd-bootx64.efi Title: UEFI OS ID: 0x0001 Status: active, boot-order Partition: /dev/disk/by-partuuid/.... File: └─/EFI/BOOT/BOOTX64.EFI Title: Windows Boot Manager ID: 0x0003 Status: inactive, boot-order Partition: /dev/disk/by-partuuid/.... File: └─/EFI/Microsoft/Boot/bootmgfw.efi $ bootctl list type: Boot Loader Specification Type #1 (.conf) title: Linux 6.6.23-gentoo-x86_64 (default) id: kernel-6.6.23-gentoo-x86_64.conf source: /boot/efi//loader/entries/kernel-6.6.23-gentoo-x86_64.conf sort-key: gentoo version: 6.6.23-gentoo-x86_64 linux: /boot/efi//vmlinuz-6.6.23-gentoo-x86_64 options: root=ZFS=[redacted] dozfs=cache ro init=/sbin/init zfs_arc_min=16G zfs_arc_max=40G spl.spl_taskq_thread_bind=0 spl.spl_taskq_thread_priority=0 init_on_alloc=0 zfs.l2arc_rebuild_blocks_min_l2size=1 pci-stub.ids=10de:1b06,10de:10ef,10de:2684,10de:22ba apparmor=1 security=apparmor hugepagesz=1G hugepages=16 nohz_full=0-7,16-23 rcu_nocbs=0-7,16-23 irqaffinity=8-15,24-31 rcu_nocb_poll cgroup_no_v1=all systemd.unified_cgroup_hierachy=1 memory_corruption_check=1 pci=nommconf pcie_aspm=off skippatcheck type: Boot Loader Specification Type #1 (.conf) title: Linux 6.6.22-gentoo-x86_64 (selected) id: kernel-6.6.22-gentoo-x86_64.conf source: /boot/efi//loader/entries/kernel-6.6.22-gentoo-x86_64.conf sort-key: gentoo version: 6.6.22-gentoo-x86_64 linux: /boot/efi//vmlinuz-6.6.22-gentoo-x86_64 options: root=ZFS=[redacted] dozfs=cache ro init=/sbin/init zfs_arc_min=16G zfs_arc_max=40G spl.spl_taskq_thread_bind=0 spl.spl_taskq_thread_priority=0 init_on_alloc=0 zfs.l2arc_rebuild_blocks_min_l2size=1 pci-stub.ids=10de:1b06,10de:10ef,10de:2684,10de:22ba apparmor=1 security=apparmor hugepagesz=1G hugepages=16 nohz_full=0-7,16-23 rcu_nocbs=0-7,16-23 irqaffinity=8-15,24-31 rcu_nocb_poll cgroup_no_v1=all systemd.unified_cgroup_hierachy=1 memory_corruption_check=1 pci=nommconf pcie_aspm=off skippatcheck
It actually might be unrelated to secure boot. With secure boot the system freeze at boot with a single message on the screen: EFI stub: UEFI Secure Boot is enabled. When I disable secure boot the screen is blank, nothing, kernel doesn't boot. On good kernel (6.6.22) with secure boot I see the message for a second and than normal kernel boot messages; without secure boot I see blank screen and than kernel messages. So, it looks like the kernel just unbootable on my system. I will try to bisect vanilla sources to find a broken commit.
Bisected to the following commit: commit 5a70baec2294e8a7d0fcc4558741c23e752dad5c Author: Tejun Heo <tj@kernel.org> Date: Mon Jan 29 08:11:25 2024 -1000 workqueue: Implement system-wide nr_active enforcement for unbound workqueues [ Upstream commit 5797b1c18919cd9c289ded7954383e499f729ce0 ] Looks like kernel command line change fixes the boot failure: -nohz_full=0-7,16-23 +nohz_full=1-7,16-23
(In reply to Ivan Volosyuk from comment #2) > Bisected to the following commit: > commit 5a70baec2294e8a7d0fcc4558741c23e752dad5c > > Author: Tejun Heo <tj@kernel.org> > > Date: Mon Jan 29 08:11:25 2024 -1000 > > > > workqueue: Implement system-wide nr_active enforcement for unbound > workqueues > > > > [ Upstream commit 5797b1c18919cd9c289ded7954383e499f729ce0 ] > > > Looks like kernel command line change fixes the boot failure: > -nohz_full=0-7,16-23 > +nohz_full=1-7,16-23 Nice job, can you report this upstream? https://bugzilla.kernel.org and then post the url here?
I contacted developer and he said the changes was never meant for 6.6.x I can see them reverted in 6.6.25 kernel.
Great news, thanks for reporting back.
