| Summary: | sys-kernel/gentoo-kernel + sys-kernel/installkernel[systemd] result in unbootable UKI on arm64 | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | Michael Jones <gentoo> |
| Component: | Current packages | Assignee: | Distribution Kernel Project <dist-kernel> |
| Status: | RESOLVED CANTFIX | ||
| Severity: | normal | CC: | gentoo, nowa |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | ARM64 | ||
| OS: | Linux | ||
| See Also: | https://bugs.gentoo.org/show_bug.cgi?id=897684 | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
|
Description
Michael Jones
2024-01-19 15:30:27 UTC
I can provide a copy of the virtual machine's disk image on request, it's built with a script so it has no personal configuration or data. Is the UKI being generated with dracut or with ukify? I suspect the issue is that the krnel version you are using does not have CONFIG_EFI_ZBOOT. If this option is set the built kernel image will be vmlinuz.efi instead of Image.gz. Could you retry with the 6.6 series? These version have this config option enabled by default. (In reply to Andrew Ammerlaan from comment #2) > Is the UKI being generated with dracut or with ukify? dracut. > I suspect the issue is that the krnel version you are using does not have > CONFIG_EFI_ZBOOT. If this option is set the built kernel image will be > vmlinuz.efi instead of Image.gz. Could you retry with the 6.6 series? These > version have this config option enabled by default. Ok, i will try that, thank you. Sadly that didn't seem to be the trick to it. Here's emerge --config gentoo-kernel with a 6.6 kernel. emerge --config gentoo-kernel Configuring pkg... Warning: ccache requested but no masquerade dir can be found in /usr/lib*/ccache/bin * Your boot partition was detected as being mounted at /boot. * Files will be installed there for gentoo-kernel to function correctly. * Installing the kernel via installkernel ... Loading /etc/kernel/install.conf… layout=uki set via /etc/kernel/install.conf INITRD_GENERATOR (dracut) set via /etc/kernel/install.conf. UKI_GENERATOR (dracut) set via /etc/kernel/install.conf. Loaded /etc/kernel/install.conf. MACHINE_ID=b45911259b79b01e08fe894a65a15cfa set via /etc/machine-id. Found container virtualization systemd-nspawn. Using XBOOTLDR partition at /boot as $BOOT_ROOT. Using entry token: b45911259b79b01e08fe894a65a15cfa kernel version (6.6.12-gentoo-dist) set via command line. kernel image file (/usr/src/linux-6.6.12-gentoo-dist/arch/arm64/boot/Image.gz) set via command line. File lacks MZ executable header. Using ENTRY_DIR=/boot/b45911259b79b01e08fe894a65a15cfa/6.6.12-gentoo-dist Using plugins: /usr/lib/kernel/install.d/00-00machineid-directory.install /usr/lib/kernel/install.d/10-copy-prebuilt.install /usr/lib/kernel/install.d/50-depmod.install /usr/lib/kernel/install.d/50-dracut.install /usr/lib/kernel/install.d/51-dracut-rescue.install /usr/lib/kernel/install.d/90-loaderentry.install /usr/lib/kernel/install.d/90-uki-copy.install Plugin environment: LC_COLLATE=C.UTF-8 KERNEL_INSTALL_VERBOSE=1 KERNEL_INSTALL_IMAGE_TYPE=unknown KERNEL_INSTALL_MACHINE_ID=b45911259b79b01e08fe894a65a15cfa KERNEL_INSTALL_ENTRY_TOKEN=b45911259b79b01e08fe894a65a15cfa KERNEL_INSTALL_BOOT_ROOT=/boot KERNEL_INSTALL_LAYOUT=uki KERNEL_INSTALL_INITRD_GENERATOR=dracut KERNEL_INSTALL_UKI_GENERATOR=dracut KERNEL_INSTALL_STAGING_AREA=/tmp/kernel-install.staging.AAr5Ic Plugin arguments: add 6.6.12-gentoo-dist /boot/b45911259b79b01e08fe894a65a15cfa/6.6.12-gentoo-dist /usr/src/linux-6.6.12-gentoo-dist/arch/arm64/boot/Image.gz Successfully forked off '(sd-exec-strv)' as PID 125. PR_SET_MM_ARG_START failed, attempting PR_SET_MM_ARG_END hack: Invalid argument PR_SET_MM_ARG_END hack failed, proceeding without: Invalid argument About to execute /usr/lib/kernel/install.d/00-00machineid-directory.install add 6.6.12-gentoo-dist /boot/b45911259b79b01e08fe894a65a15cfa/6.6.12-gentoo-dist /usr/src/linux-6.6.12-gentoo-dist/arch/arm64/boot/Image.gz Successfully forked off '(direxec)' as PID 127. /usr/lib/kernel/install.d/00-00machineid-directory.install succeeded. About to execute /usr/lib/kernel/install.d/10-copy-prebuilt.install add 6.6.12-gentoo-dist /boot/b45911259b79b01e08fe894a65a15cfa/6.6.12-gentoo-dist /usr/src/linux-6.6.12-gentoo-dist/arch/arm64/boot/Image.gz Successfully forked off '(direxec)' as PID 131. /usr/lib/kernel/install.d/10-copy-prebuilt.install succeeded. About to execute /usr/lib/kernel/install.d/50-depmod.install add 6.6.12-gentoo-dist /boot/b45911259b79b01e08fe894a65a15cfa/6.6.12-gentoo-dist /usr/src/linux-6.6.12-gentoo-dist/arch/arm64/boot/Image.gz Successfully forked off '(direxec)' as PID 138. +depmod -a 6.6.12-gentoo-dist /usr/lib/kernel/install.d/50-depmod.install succeeded. About to execute /usr/lib/kernel/install.d/50-dracut.install add 6.6.12-gentoo-dist /boot/b45911259b79b01e08fe894a65a15cfa/6.6.12-gentoo-dist /usr/src/linux-6.6.12-gentoo-dist/arch/arm64/boot/Image.gz Successfully forked off '(direxec)' as PID 142. dracut[I]: Executing: /usr/bin/dracut -f --noimageifnotneeded --verbose --kernel-image /usr/src/linux-6.6.12-gentoo-dist/arch/arm64/boot/Image.gz --uefi --kver 6.6.12-gentoo-dist /tmp/kernel-install.staging.AAr5Ic/uki.efi dracut[I]: Module 'dash' will not be installed, because command 'dash' could not be found! dracut[I]: Module 'mksh' will not be installed, because command 'mksh' could not be found! dracut[I]: Module 'systemd-integritysetup' will not be installed, because command '/usr/lib/systemd/systemd-integritysetup' could not be found! dracut[I]: Module 'systemd-integritysetup' will not be installed, because command '/usr/lib/systemd/system-generators/systemd-integritysetup-generator' could not be found! dracut[I]: Module 'systemd-pcrphase' will not be installed, because command '/usr/lib/systemd/systemd-pcrphase' could not be found! dracut[I]: Module 'systemd-pcrphase' will not be installed, because command '/usr/lib/systemd/systemd-pcrextend' could not be found! dracut[I]: Module 'systemd-veritysetup' will not be installed, because command '/usr/lib/systemd/systemd-veritysetup' could not be found! dracut[I]: Module 'systemd-veritysetup' will not be installed, because command '/usr/lib/systemd/system-generators/systemd-veritysetup-generator' could not be found! dracut[I]: Module 'modsign' will not be installed, because command 'keyctl' could not be found! dracut[I]: Module 'busybox' will not be installed, because command 'busybox' could not be found! dracut[I]: Module 'dbus-broker' will not be installed, because command 'dbus-broker' could not be found! dracut[I]: Module 'rngd' will not be installed, because command 'rngd' could not be found! dracut[I]: Module 'connman' will not be installed, because command 'connmand' could not be found! dracut[I]: Module 'connman' will not be installed, because command 'connmanctl' could not be found! dracut[I]: Module 'connman' will not be installed, because command 'connmand-wait-online' could not be found! dracut[I]: Module 'network-legacy' will not be installed, because command 'dhclient' could not be found! dracut[I]: Module 'network-manager' will not be installed, because command 'NetworkManager' could not be found! dracut[I]: 62bluetooth: Could not find any command of '/usr/lib/bluetooth/bluetoothd /usr/libexec/bluetooth/bluetoothd'! dracut[I]: Module 'lvmmerge' will not be installed, because command 'lvm' could not be found! dracut[I]: Module 'lvmthinpool-monitor' will not be installed, because command 'lvm' could not be found! dracut[I]: Module 'btrfs' will not be installed, because command 'btrfs' could not be found! dracut[I]: 90crypt: Could not find any command of '/usr/lib/systemd/systemd-cryptsetup cryptsetup'! dracut[I]: Module 'dm' will not be installed, because command 'dmsetup' could not be found! dracut[I]: Module 'dmraid' will not be installed, because command 'dmraid' could not be found! dracut[I]: Module 'dmsquash-live-ntfs' will not be installed, because command 'ntfs-3g' could not be found! dracut[I]: Module 'lvm' will not be installed, because command 'lvm' could not be found! dracut[I]: Module 'mdraid' will not be installed, because command 'mdadm' could not be found! dracut[I]: Module 'multipath' will not be installed, because command 'multipath' could not be found! dracut[I]: Module 'pcsc' will not be installed, because command 'pcscd' could not be found! dracut[I]: Module 'tpm2-tss' will not be installed, because command 'tpm2' could not be found! dracut[I]: Module 'cifs' will not be installed, because command 'mount.cifs' could not be found! dracut[I]: Module 'fcoe' will not be installed, because command 'dcbtool' could not be found! dracut[I]: Module 'fcoe' will not be installed, because command 'fipvlan' could not be found! dracut[I]: Module 'fcoe' will not be installed, because command 'lldpad' could not be found! dracut[I]: Module 'fcoe' will not be installed, because command 'fcoemon' could not be found! dracut[I]: Module 'fcoe' will not be installed, because command 'fcoeadm' could not be found! dracut[I]: Module 'fcoe-uefi' will not be installed, because command 'dcbtool' could not be found! dracut[I]: Module 'fcoe-uefi' will not be installed, because command 'fipvlan' could not be found! dracut[I]: Module 'fcoe-uefi' will not be installed, because command 'lldpad' could not be found! dracut[I]: Module 'iscsi' will not be installed, because command 'iscsi-iname' could not be found! dracut[I]: Module 'iscsi' will not be installed, because command 'iscsiadm' could not be found! dracut[I]: Module 'iscsi' will not be installed, because command 'iscsid' could not be found! dracut[I]: Module 'nbd' will not be installed, because command 'nbd-client' could not be found! dracut[I]: 95nfs: Could not find any command of 'rpcbind portmap'! dracut[I]: Module 'nvmf' will not be installed, because command 'nvme' could not be found! dracut[I]: Module 'nvmf' will not be installed, because command 'jq' could not be found! dracut[I]: Module 'biosdevname' will not be installed, because command 'biosdevname' could not be found! dracut[I]: Module 'memstrack' will not be installed, because command 'memstrack' could not be found! dracut[I]: memstrack is not available dracut[I]: If you need to use rd.memdebug>=4, please install memstrack and procps-ng dracut[I]: Module 'squash' will not be installed, because command 'mksquashfs' could not be found! dracut[I]: Module 'squash' will not be installed, because command 'unsquashfs' could not be found! dracut[I]: *** Including module: systemd *** dracut[I]: *** Including module: systemd-initrd *** dracut[I]: *** Including module: systemd-journald *** dracut[I]: *** Including module: systemd-pstore *** dracut[I]: *** Including module: systemd-repart *** dracut[I]: *** Including module: systemd-sysusers *** dracut[I]: *** Including module: systemd-tmpfiles *** dracut[I]: *** Including module: systemd-udevd *** dracut[I]: *** Including module: i18n *** dracut[I]: *** Including module: kernel-modules *** dracut[I]: *** Including module: kernel-modules-extra *** dracut[D]: kernel-modules-extra: configuration source "/run/depmod.d" does not exist dracut[D]: kernel-modules-extra: configuration source "/etc/depmod.d" does not exist dracut[D]: kernel-modules-extra: configuration source "/lib/depmod.d" does not exist dracut[I]: *** Including module: nvdimm *** dracut[I]: *** Including module: qemu *** dracut[I]: *** Including module: qemu-net *** dracut[I]: *** Including module: lunmask *** dracut[I]: *** Including module: resume *** dracut[I]: *** Including module: rootfs-block *** dracut[I]: *** Including module: terminfo *** dracut[I]: *** Including module: udev-rules *** dracut[I]: *** Including module: virtiofs *** dracut[I]: *** Including module: dracut-systemd *** dracut[I]: *** Including module: usrmount *** dracut[I]: *** Including module: base *** dracut[I]: *** Including module: fs-lib *** dracut[I]: *** Including module: shutdown *** dracut[I]: *** Including modules done *** dracut[I]: *** Installing kernel module dependencies *** dracut[I]: *** Installing kernel module dependencies done *** dracut[I]: *** Resolving executable dependencies *** dracut[I]: *** Resolving executable dependencies done *** dracut[I]: *** Hardlinking files *** dracut[D]: Mode: real dracut[D]: Method: sha256 dracut[D]: Files: 2493 dracut[D]: Linked: 4 files dracut[D]: Compared: 0 xattrs dracut[D]: Compared: 404 files dracut[D]: Saved: 6.9 KiB dracut[D]: Duration: 0.021532 seconds dracut[I]: *** Hardlinking files done *** dracut[I]: *** Generating early-microcode cpio image *** dracut[I]: *** Store current command line parameters *** dracut[I]: *** Stripping files *** dracut[I]: *** Stripping files done *** dracut[I]: *** Creating image file '/tmp/kernel-install.staging.AAr5Ic/uki.efi' *** dracut[I]: Using auto-determined compression method 'gzip' The error message in the uefi bootloader looks to be roughly the same. Right, that is my mistake, I forgot we only enable CONFIG_EFI_ZBOOT if USE=secureboot is enabled. The kernel image file is still in the Image.gz format:
> kernel image file (/usr/src/linux-6.6.12-gentoo-dist/arch/arm64/boot/Image.gz)
Could you try enabling USE+secureboot or overriding CONFIG_EFI_ZBOOT=y via /etc/kernel/config,d? You should see the name of the kernel image change to vmlinuz.efi.
Alternatively, for a quick test you can try gentoo-kernel-bin, those images are built with USE=secureboot enabled.
If it still does not work you could try generating the UKI with ukify instead of dracut, I haven't looked into the details but as I understand it ukify generates a slightly different UKI.
(In reply to Andrew Ammerlaan from comment #6) > Right, that is my mistake, I forgot we only enable CONFIG_EFI_ZBOOT if > USE=secureboot is enabled. The kernel image file is still in the Image.gz > format: > > > kernel image file (/usr/src/linux-6.6.12-gentoo-dist/arch/arm64/boot/Image.gz) > > Could you try enabling USE+secureboot or overriding CONFIG_EFI_ZBOOT=y via > /etc/kernel/config,d? You should see the name of the kernel image change to > vmlinuz.efi. > > Alternatively, for a quick test you can try gentoo-kernel-bin, those images > are built with USE=secureboot enabled. > > If it still does not work you could try generating the UKI with ukify > instead of dracut, I haven't looked into the details but as I understand it > ukify generates a slightly different UKI. I dropped a new config file /etc/kernel/config.d/EFI_ZBOOT.config with contents ``` CONFIG_EFI_ZBOOT=n ``` e.g. drive /usr/src/linux-6.6.12-gentoo-dist # cat /etc/kernel/config.d/EFI_ZBOOT.config CONFIG_EFI_ZBOOT=n and then emerge -C gentoo-kernel emerge gentoo-kernel I checked the resulting .config file drive /usr/src/linux-6.6.12-gentoo-dist # grep EFI_ZBOOT -r .config # CONFIG_EFI_ZBOOT is not set but it looks like it still is producing the Image.gz drive /usr/src/linux-6.6.12-gentoo-dist/arch/arm64/boot # ls Image.gz Makefile dts Did I perhaps have something wrong with my EFI_ZBOOT.config file? Ah i tried with secureboot and signed-modules, but don't have a signing key, so it failed out. It should be =y instead of =n. We need to *enable* this option so the kernel builds its own decompressor (zboot) and the (stub) bootloader is no longer responsible for decompressing the kernel image. Ah, ok, thanks for the correction. Changing to =y allowed me to boot with the resulting UKI. Will this only work on 6.6? or will the stable 6.1 work with this config option? (In reply to Michael Jones from comment #10) > Ah, ok, thanks for the correction. > > Changing to =y allowed me to boot with the resulting UKI. Great! > Will this only work on 6.6? or will the stable 6.1 work with this config > option? This config option was added in 6.1 so it should work, though we have only tried this in I think 6.3 and up. That being said, 6.6 is stable now. Closing this, I think there's nothing we can do here other then document this requirement on the wiki (which I will do now). |
