3 ms·
> Does that make kernel updates a more manual process? Are you building your own? In Debian/Ubuntu it should be on by default, and has been for almost a decade
by josteink 6y ago
> Does that make kernel updates a more manual process? Are you building your own?
In Debian/Ubuntu it should be on by default, and has been for almost a decade:
https://askubuntu.com/questions/510009/does-the-ubuntu-kernel-have-efi-stub-loader-boot-support https://askubuntu.com/questions/510009/does-the-ubuntu-kerne...
That means you can run your kernel directly as a UEFI-target and it will support secure-boot.
- alias_neo 6y agoThanks, by "it" I now understand you mean that CONFIG_EFI_STUB=y is on by default. This is the feature required to boot the kernel directly as an UEFI-target, now I need to look into how I make it an UEFI-target, I believe I need to use bootmgr as GP has, but I need to use my kernel image as the EFI image? EDIT: I managed to create the target, with efibootmgr and boot it partly but it panics. I assume that's due to FDE so I'll have to look into how to configure it to support that (if it's possible without a bootloader).
- tremon 6y agoit's possible, but you must include the path to the initramfs as a kernel parameter (using DOS-style paths, not sure if unix-style works too). A linux-aware bootloader will usually load the initramfs itself and pass linux the memory address where it's loaded, in UEFI the kernel gets "executed" like a normal executable, so it has a commandline but not a pre-loaded initramfs. My efibootmgr entry looks like this (root is btrfs on LUKS): HD(disk-id)/File(\vmlinux-5.6.0-2-rt-amd64) initrd=\initrd.img-5.6.0-2-rt-amd64 ro root=/dev/mapper/cryptpv0 The latter part is what you must supply manually if you want to start the kernel from the UEFI command line.
- alias_neo 6y agoGreat thanks, I'll give this another go.