Meta tags:
description=Just another blog;

Headings (most frequently used words):

kernel, the, gentoo, generic, configuration, troubleshooting, installing, updates, boot, on, shim, grub, rasdaemon, key, configuring, and, with, setting, in, mok, list, secure, 15, 10, monitoring, ecc, memory, linux, 19, compose, xfce, 14, preparing, system, up, signing, keys, required, packages, bootloaders, importing, creating, new, efi, entry, reboot, enrolling, conclusion, updating, dimm, labels, binary, distribution, built, from, sources, custom, bootloader, windows, dual, motherboard, uefi, firmware,

Text of the page (most frequently used words):
the (445), kernel (128), you (119), and (102), efi (102), boot (96), gentoo (92), grub (90), this (71), that (70), will (66), #configuration (60), with (54), shim (52), use (44), key (44), sys (43), package (41), can (41), for (41), file (37), using (36), #rasdaemon (32), bootloader (32), install (29), your (29), mok (29), linux (26), need (26), now (26), modules (24), have (23), etc (20), ras (20), signed (20), usr (19), from (19), ctl (19), which (18), loaded (18), are (18), portage (18), list (18), new (17), enabled (17), secureboot (17), one (15), note (15), add (15), when (15), installing (15), executable (15), following (14), set (14), dimm (14), errors (14), keys (14), root (14), under (13), then (13), out (13), time (13), but (13), all (13), load (13), system (13), also (13), make (13), mokutil (13), config (12), sources (12), fedora (12), every (12), generic (12), some (12), compose (12), been (12), secure (12), machine (12), other (12), entry (12), 0csrow (12), update (12), based (11), bit (11), default (11), installation (11), option (11), edac (11), automatically (11), troubleshooting (11), only (11), already (11), uefi (11), enroll (11), partition (11), distribution (11), pem (11), gabriele (10), svelto (10), stable (10), into (10), command (10), has (10), instead (10), memory (10), label (10), dimm_b1 (10), reboot (10), used (10), bootx64 (10), binary (10), copy (9), build (9), usual (9), hardware (9), not (9), windows (9), updated (9), labels (9), dimm_b2 (9), once (9), updates (9), cfg (9), sign (9), proceed (8), src (8), work (8), like (8), more (8), debian (8), path (8), echo (8), built (8), don (8), firmware (8), version (8), profile (8), share (8), mmx64 (8), grubx64 (8), import (8), want (7), might (7), supports (7), useful (7), setting (7), should (7), channel (7), generate (7), marked (7), few (7), enables (7), openrc (7), line (7), files (7), mode (7), lockdown (7), disk (7), service (7), error (7), case (7), them (7), motherboard (7), create (7), configuring (7), emerge (7), packages (7), ecc (7), signing (7), patches (7), script (7), ask (7), custom (7), rename (6), practically (6), missing (6), while (6), contains (6), step (6), example (6), building (6), systemd (6), run (6), needs (6), start (6), model (6), name (6), first (6), disabled (6), nvme (6), baked (6), flag (6), installed (6), dual (6), bashrc (6), ebegin (6), eend (6), let (6), alongside (6), efibootmgr (6), standalone (6), mount (6), latest (5), well (5), there (5), way (5), find (5), its (5), enable (5), launch (5), settings (5), done (5), just (5), specific (5), tweaks (5), existence (5), lot (5), bleeding (5), edge (5), functionality (5), remove (5), than (5), information (5), integrity (5), module (5), they (5), summary (5), after (5), here (5), dimm_a1 (5), dimm_a2 (5), slot (5), another (5), hand (5), section (5), having (5), apps (5), kmod (5), two (5), chain (5), verify (5), password (5), being (5), during (5), move (5), bootloaders (5), x509 (5), certificate (5), contents (4), get (4), such (4), security (4), features (4), take (4), either (4), support (4), right (4), editor (4), tool (4), ago (4), config_gentoo_linux_init_systemd (4), config_gentoo_linux_init_script (4), previous (4), variable (4), manually (4), events (4), running (4), print (4), systemctl (4), mc0 (4), csrow (4), physical (4), vendor (4), data (4), format (4), 2channel (4), 3channel (4), conf (4), booting (4), facility (4), finally (4), monitor (4), both (4), requires (4), drive (4), without (4), changes (4), sure (4), creating (4), updating (4), enrolling (4), image (4), fix (4), mkconfig (4), regenerated (4), executables (4), about (4), how (4), next (4), notice (4), part (4), keyring (4), signature (4), procedure (4), downside (3), quite (3), haven (3), handbook (3), look (3), left (3), via (3), keep (3), amount (3), confidentiality (3), drivers (3), check (3), particular (3), prints (3), since (3), ubuntu (3), distros (3), names (3), count (3), entries (3), asustek (3), computer (3), inc (3), prime (3), b450 (3), plus (3), put (3), separate (3), was (3), point (3), record (3), different (3), disable (3), sqlite (3), rebooted (3), distributions (3), kernels (3), possible (3), debugging (3), logo (3), config_acpi_extlog (3), clock (3), osclock (3), hwclock (3), rtc (3), ntp (3), synchronization (3), core (3), initrd (3), convenience (3), binfmt_misc (3), notable (3), compared (3), posts (3), compressed (3), zstd (3), additionally (3), firmwares (3), issue (3), happens (3), steps (3), follow (3), pre (3), mkdir (3), parents (3), upstream (3), device (3), patch (3), place (3), post_pkg_postinst (3), able (3), lib (3), x86_64 (3), turn (3), these (3), choose (3), verified (3), presented (3), upon (3), bootorder (3), 0003 (3), dev (3), happen (3), enrollment (3), cer (3), force (3), process (3), environment (3), loads (3), our (3), certs (3), signing_key (3), instructions (3), required (3), guide (3), 2026 (2), everything (2), approach (2), important (2), very (2), good (2), around (2), provides (2), often (2), needed (2), user (2), enabling (2), proper (2), turning (2), before (2), 2018 (2), resulting (2), ctrl (2), win (2), property (2), keyboard (2), layout (2), applications (2), xfce (2), accessible (2), days (2), match (2), occupy (2), storage (2), 2019 (2), appropriate (2), hasn (2), yet (2), userspace (2), access (2), suitable (2), those (2), grub_cmdline_linux_default (2), usually (2), prevent (2), fails (2), provide (2), amd64_edac_mod (2), ones (2), corrected (2), location (2), counts (2), stored (2), across (2), reboots (2), output (2), startup (2), printing (2), replaced (2), dimm_labels (2), per (2), separating (2), given (2), row (2), mainboard (2), mapping (2), fine (2), 0channel (2), 1channel (2), corresponds (2), write (2), paths (2), represents (2), number (2), uncorrectable (2), detected (2), opensuse (2), setup (2), itself (2), app (2), admin (2), recommend (2), currently (2), become (2), handle (2), config_module_compress_zstd (2), many (2), various (2), bits (2), reduce (2), config_gentoo_print_firmware_info (2), implicitly (2), additional (2), hardening (2), config_gentoo_kernel_self_protection (2), largely (2), enough (2), sometimes (2), again (2), https (2), salsa (2), org (2), team (2), raw (2), 9cbf984566f08c7b7dc9b5fb26aacec22cdde891 (2), oneshot (2), does (2), versions (2), old (2), due (2), shiminstall (2), copying (2), same (2), described (2), above (2), won (2), existing (2), verifying (2), unbootable (2), grubinstall (2), called (2), hook (2), instruct (2), backing (2), whenever (2), something (2), worth (2), mentioning (2), correctly (2), grub_cfg (2), menu (2), always (2), conclusion (2), asked (2), enrolled (2), added (2), what (2), management (2), adjust (2), order (2), gpt (2), sda1 (2), partition_number (2), disk_with_efi_partition (2), because (2), actual (2), ignore (2), complains (2), wiped (2), discarded (2), afterwards (2), too (2), importing (2), env (2), modify (2), signatures (2), gpg (2), generated (2), inform (2), thus (2), shim_lock (2), prober (2), grub_disable_os_prober (2), grub_platforms (2), made (2), dist (2), bin (2), source (2), loading (2), pkcs7 (2), owner (2), secureboot_sign_key (2), secureboot_sign_cert (2), modules_sign_key (2), modules_sign_cert (2), openssl (2), outform (2), der (2), assumes (2), mounted (2), preparing (2), off (2), microsoft (2), blog (2), powered, nikola, started, quickly, follows, kitchen, sink, desktop, pcs, laptops, servers, includes, kpti, large, long, compile, date, genkernel, almost, making, working, confusing, daunting, developer, simply, encountered, ralt, alt, lctrl, rctrl, lwin, rwin, value, enter, values, xkboptions, select, terminal, executing, xfce4, handy, characters, aren, available, isn, readily, rather, easily, posted, mind, less, strict, permits, fair, lives, deployments, must, untrusted, code, quiet, splash, achieved, editing, changing, include, likely, reading, gather, statistics, switch, loader, complaining, debugfs, filesystem, doesn, details, documentation, lsmod, grep, 32768, edac_mce_amd, 28672, status, controller, pcie, aer, uncorrected, non, fatal, bit21, extlog, devlink, 6646, mce, rebooting, continually, recording, seen, recorded, persisted, persist, rac, configured, sysfs, much, better, figure, dimms, faulty, register, ready, bunch, motherboards, repo, utils, looks, asus, lines, string, numbers, corresponding, semicolon, associated, sequences, comma, sudo, obtain, text, fill, identify, inserted, down, insterted, readable, idea, slots, confirm, column, were, shows, devices, query, give, level, rasdaemon_args, entirely, database, makes, particularly, machines, amd64, keywords, unstable, unmask, zypper, dnf, apt, intall, packaged, most, rasdeamon, recent, tools, report, correctable, see, little, tweaking, know, exactly, experiencing, workstation, amd, ryzen, threadripper, intel, xeon, processor, chances, worthy, investment, improve, reliability, properly, monitored, allow, spot, problems, catastrophic, 2020, monitoring, 2021, maximum, compatibility, compression, suggest, significant, space, savings, effectively, impact, times, weeks, wanted, kept, struggling, really, silly, adapting, 2022, supported, compressing, thing, reason, respectively, config_module_compress_none, branch, months, busy, forgot, publish, 2023, similarly, cleared, removing, repeat, clears, fail, wget, chainloader, writing, contain, shipped, rebuild, ships, works, bug, configure, temporarily, solve, problem, sbat, failed, policy, violation, failure, message, highly, recommended, failing, lead, older, progressively, unsafe, refuse, function, generating, execute, anyway, directories, post, below, beware, however, goes, wrong, big, risk, even, outdated, otherwise, regenerate, eclean, wonder, deal, state, had, operating, systems, appear, any, validated, booted, back, memtest86, entered, input, anymore, yes, continue, selected, yours, view, ensure, expect, pressing, tried, apologize, horrible, moiré, artifacts, pictures, shim_entry, other_entry, starts, bootcurrent, timeout, seconds, 0000, 0017, 0018, 0019, 001a, 001b, 001c, 001d, 001e, 001f, 0024, 0002, boot0003, e8389b70, d497, 40e7, 94a5, 0b4a48732aa0, 0x800, 0x82000, double, sda, holds, table, created, last, second, remember, trying, possibly, 99grub, installkernel, said, adding, maintaining, unwieldy, prone, exercise, addition, produces, single, memdisk, holding, potentially, fonts, themes, greatly, reducing, maintenance, burden, sit, why, verifier, mechanism, causes, validate, including, traditional, store, separately, require, each, false, options, explicitly, placed, expects, got, manipulate, latter, folder, inside, sbsign, cert, crt, vmlinuz, modules_install, config_module_sig_force, config_module_sig_key, own, specify, checks, aforementioned, third, party, loadable, directory, public, anything, else, completely, vanilla, refer, depending, type, newuse, rebuilding, show, modinfo, flags, variables, practice, offline, simplicity, removable, later, req, nodes, utf8, sha256, keyout, subj, rsa, 2048, vfat, defaults, fat, formatted, partitioning, present, fstab, chapter, fact, live, entire, ever, never, breaking, optionally, enforce, managed, provided, several, ways, goal, method, chosen, uses, august, slightly, original, relied, contained, relies, read, external, convenient, users, getting, traditionally, tricky, widespread, absence, loaders, mainstream, spread, through, wiki, decided, easy, tutorial, 2024, rss, feed, tags, archives, mips, creator, ci20, resources, pages, skip, main, content,

Text of the page (random words):
y cert root secureboot mok crt boot vmlinuz version that s it you can now move on to the installing the shim and grub bootloaders section installing the shim and grub bootloaders now let s add a folder for our bootloader to the efi partition and move the shim bootloader inside of it mkdir parents boot efi efi gentoo cp usr share shim mmx64 efi boot efi efi gentoo cp usr share shim bootx64 efi boot efi efi gentoo notice how the shim bootloader is made up of two executables the actual bootloader bootx64 efi and a tool to manipulate the mok list mmx64 efi the latter will be used during the first reboot to enroll our keys the next step is to install grub make sure that you ve got uefi support enabled by setting the grub_platforms variable in make conf grub_platforms efi 64 if you want to dual boot windows or other linux distributions enable the mount use flag so that grub s os prober will be able to find them echo sys boot grub mount etc portage package use now install the grub package emerge ask sys boot grub installing the package is enough to generate the signed grub efi executable so let s install it alongside the shim bootloader in the efi partition cp usr lib grub grub x86_64 efi signed boot efi efi gentoo grubx64 efi note that we ve placed the signed grub bootloader next to the shim bootloader it needs to be called grubx64 efi because that s what the shim bootloader expects to find now adjust the etc default grub configuration file with the options suitable for your machine in case you want to dual boot windows you ll need to explicitly set the grub_disable_os_prober option enable os prober grub_disable_os_prober false we can now generate grub s configuration which will sit alongside the bootloader efi executable so it s worth mentioning why the bootloader executable itself already contains all the modules and we don t need to install them with the grub install tool by default grub s configuration will use the shim_lock verifier this is a mechanism that causes the shim bootloader to inform grub that it s being loaded in a secure boot environment and thus it s now grub s turn to validate the boot chain when this happens grub will verify all the executable files it loads including its modules a traditional grub installation will store all these files separately and require a separate gpg signature for each of them adding and maintaining these signatures is an unwieldy and error prone exercise and requires a separate gpg key in addition to the ones we ve already generated a standalone installation on the other hand produces a single executable which contains a memdisk holding all the modules and potentially fonts themes as well as the configuration this executable needs to be signed only once which happens when we install or update the package greatly reducing the maintenance burden with that said let s proceed we ll generate grub s configuration using grub mkconfig then modify the environment so that it will be regenerated correctly when need be grub mkconfig o boot efi efi gentoo grub cfg finally let s add the path to this configuration to the environment this way whenever you ll install a new kernel grub s configuration file will be automatically regenerated by the installkernel package echo grub_cfg boot efi efi gentoo grub cfg etc env d 99grub env update importing the key in the mok list it s now time to import the key we ve used to sign grub and possibly the kernel too into the mok list this is a two step process the first part is to import the key mokutil import root secureboot mok cer mokutil will ask for a password to enroll the key this will be used only once after you have rebooted the system during the enrollment process it can be discarded afterwards if mokutil complains about the key already being in the keyring you can force it to be loaded like this this might happen if a firmware update wiped the mok list and you need to re enroll the key mokutil ignore keyring import root secureboot mok cer the second part will happen upon the next reboot remember the mmx64 efi file we ve put in the efi partition alongside the shim bootloader upon being loaded shim will notice that we re trying to import a key in the mok and launch it to do the actual enrollment creating a new efi boot entry the last step is to create a new efi boot entry for the shim bootloader note that we don t need an entry for grub because it will be loaded via shim the boot entry can be created with this command efibootmgr disk disk_with_efi_partition part partition_number create l shim l efi gentoo bootx64 efi disk_with_efi_partition is the disk which holds the efi partition and partition_number is the number of the efi partition in the gpt table so if your efi partition is on the dev sda1 device you ll create the boot entry with efibootmgr disk dev sda part 1 create l shim l efi gentoo bootx64 efi this command should also set the new boot entry as the default one double check it with efibootmgr bootcurrent 0003 timeout 0 seconds bootorder 0003 0000 0017 0018 0019 001a 001b 001c 001d 001e 001f 0024 0002 boot0003 shim hd 1 gpt e8389b70 d497 40e7 94a5 0b4a48732aa0 0x800 0x82000 file efi gentoo bootx64 efi notice how the bootorder variable starts with 0003 which corresponds to the shim entry in this example if this is not the case adjust the boot order using efibootmgr bootorder shim_entry other_entry reboot enrolling the key in the mok list you can now reboot your machine upon the next reboot the shim bootloader will notice that you tried to enroll a new key and load the shim uefi key management executable it will look like this i apologize for the horrible moiré artifacts on the pictures after pressing a key you ll be presented with the key management menu choose the enroll mok entry you will presented with the list of keys you enrolled one if you only added yours or two if you also added the gentoo kernel distribution key you can view the keys to ensure they re what you expect here s the information about the selected key once you ve verified you re enrolling the proper keys choose continue you will be asked if you want to enroll the key s choose yes you will now be asked for the password you used when you enrolled the key using mokutil input the password you won t need it anymore once this is done once you ve entered the password it s time to reboot conclusion you re done your machine should now reboot using the shim bootloader which will in turn load grub if you had other operating systems such as windows these should appear in the menu as well as other uefi executables like memtest86 for example booting any of the entries should work and provide a validated boot chain once you ve booted back into gentoo you can always verify that this is the case by using mokutil again mokutil sb state secureboot enabled updating and troubleshooting you might wonder about how to deal updates to the packages we ve used when setting everything up here s how kernel updates if you ve setup the grub_cfg configuration variable as described above then the grub cfg file will be regenerated automatically every time you install a new kernel or remove one with eclean kernel otherwise you ll have to regenerate the grub cfg file by hand and place it alongside the grub and shim executables grub updates when the sys boot grub package is updated you should update your installation and re create the configuration file note that your system will keep booting correctly even if you don t but you ll be running an outdated bootloader cp usr lib grub grub x86_64 efi signed boot efi efi gentoo grubx64 efi grub mkconfig o boot efi efi gentoo grub cfg it is also possible to automatically update grub using a post installation hook by using the script below both the grub efi executable and the configuration file will be automatically replaced whenever you update or re install the sys boot grub package beware however that if something goes wrong this might make your machine unbootable and you ll have to fix it by hand it s not a big risk but it s worth mentioning it anyway let s add the appropriate directories to your portage profile if they re not already there yet mkdir parents etc portage profile bashrc etc portage profile package bashrc now we ll add a script in your portage profile that will execute the steps needed to update the grub efi executable copy the following script into etc portage profile bashrc grubinstall post_pkg_postinst ebegin backing up the grub bootloader to boot efi efi gentoo grubx64 efi mv boot efi efi gentoo grubx64 efi boot efi efi gentoo grubx64 efi eend ebegin backing up the grub configuration to boot efi efi gentoo grub cfg mv boot efi efi gentoo grub cfg boot efi efi gentoo grub cfg eend ebegin installing the grub bootloader to boot efi efi gentoo grubx64 efi cp usr lib grub grub x86_64 efi signed boot efi efi gentoo grubx64 efi eend ebegin generating a new grub configuration file grub mkconfig o boot efi efi gentoo grub cfg eend note that the script contains only one function called post_pkg_postinst it s a hook that portage will run after having installed a package so now we have to instruct portage to run this script every time the sys boot grub package is installed echo sys boot grub grubinstall etc portage profile package bashrc grub and you re done shim bootloader updates troubleshooting if the sys boot shim package is updated it is highly recommended to also update your installation failing to do so might lead to an unbootable system as older versions of the package are progressively marked as unsafe and new uefi firmwares will refuse to boot them to update the shim bootloader first update the package then manually copy the new version to the efi partition cp usr share shim mmx64 efi boot efi efi gentoo cp usr share shim bootx64 efi boot efi efi gentoo in particular you ll have to update the shim bootloader if you get a boot failure with the following error message verifying shim sbat data failed security policy violation you won t be able to boot with the existing bootloader and you ll have to either temporarily disable secure boot or boot with another bootloader to fix the issue updating shim will solve the problem shim can be updated automatically using the same approach described above for grub copy the following script to etc portage profile bashrc shiminstall post_pkg_postinst ebegin copying usr share shim bootx64 efi to boot efi efi gentoo bootx64 efi cp usr share shim bootx64 efi boot efi efi gentoo bootx64 efi eend ebegin copying usr share shim mmx64 efi to boot efi efi gentoo mmx64 efi cp usr share shim mmx64 efi boot efi efi gentoo mmx64 efi eend and configure portage to run this script every time the sys boot shim package is installed or updated echo sys boot shim shiminstall etc portage profile package bashrc shim windows dual boot troubleshooting gentoo currently ships two versions of shim 15 8 and 16 1 dual booting windows using the old version works fine but fails with the new one due to an upstream bug in grub at the time of writing gentoo s grub package sys boot grub 2 14 r5 does not contain a fix but it is possible to patch it to fix the issue by using two patches shipped with debian s grub package you ll need to place both patches under etc portage patches sys boot grub and rebuild the package mkdir parents etc portage patches sys boot grub wget p etc portage patches sys boot grub https salsa debian org grub team grub raw 9cbf984566f08c7b7dc9b5fb26aacec22cdde891 debian patches upstream efi linux set loaded image device path patch https salsa debian org grub team grub raw 9cbf984566f08c7b7dc9b5fb26aacec22cdde891 debian patches upstream efi chainloader set loaded image device path patch emerge oneshot sys boot grub motherboard uefi firmware updates troubleshooting updating the motherboard uefi firmware sometimes clears the mok list if that s the case your system will fail to boot and you will have to enroll your key again follow the steps in reboot enrolling the key in the mok list to enroll your key once more also re enroll gentoo s signing key if you re using a pre built kernel similarly sometimes the uefi boot list will be cleared removing the shim boot entry if it happens repeat the steps in creating a new efi boot entry to create a new one gentoo 6 1 x generic kernel configuration gabriele svelto 2023 11 26 08 43 the 6 1 x branch of the linux kernel has been marked as stable in gentoo for a few months already and i was busy enough that i forgot to publish an updated generic kernel configuration for it as with my previous posts this configuration is largely based on the fedora kernel with some gentoo specific tweaks it supports practically every bit of hardware in existence and enables a lot of bleeding edge kernel functionality the only few notable changes compared to the fedora kernel are the following the binfmt_misc module is baked in for convenience the nvme core modules are baked in so you can boot from an nvme drive without having to use an initrd the config_acpi_extlog option is enabled this is useful if you re using rasdaemon to monitor ecc memory the boot logo is disabled kernel debugging is disabled the config_gentoo_kernel_self_protection option is enabled this implicitly enables an additional set of security features for hardening the kernel the config_gentoo_print_firmware_info option is enabled it prints out the firmwares that are loaded into various bits of hardware this is useful if you want to reduce the amount of files installed sys kernel linux firmware package note that the rtc time based on ntp synchronization is enabled so if you re using openrc you don t need the hwclock service but you can use osclock instead if some other service requires the clock facility additionally note that this kernel configuration is for use with openrc if you re using systemd you ll have to remove the config_gentoo_linux_init_script y line from the configuration file and add config_gentoo_linux_init_systemd y instead now that zstd is well supported in many packages i have enabled it for compressing kernel modules the only thing you need to make sure to use it is that the sys apps kmod package has the zstd use flag set so that it can handle the compressed modules if for some reason you don t want modules to be compressed set config_module_compress_zstd n and config_module_compress_none y respectively to use this configuration file install the latest stable sys kernel gentoo sources package 6 1 x copy the configuration file under usr src linux and rename it to config then proceed to build and install the kernel as usual gentoo 6 1 x kernel configuration file gentoo 5 15 x generic kernel configuration gabriele svelto 2022 01 11 09 12 the 5 15 11 linux kernel has been marked as stable in gentoo a few weeks ago and i ve wanted to put out a new generic kernel configuration but i kept struggling with a really silly issue adapting it as with my previous posts this configuration is largely based on the fedora kernel with some ...