{{Header}} __FORCETOC__
{{title|title=
Boot Process
}}
{{#seo:
|description=Boot Process Related Development Notes
}}
{{dev_image_mininav}}
{{boot_firmware}}
{{intro|
Boot Process Related Development Notes
}}
= GRUB =
== grub-install command responsibility ==
Who should run the grub-install
command? SystemBuildTools or Debian package maintainer scripts?
As it is currently designed, it seems [https://wiki.debian.org/SystemBuildTools SystemBuildTools] are supposed to execute the grub-install
command.
calamares
installer runs grub-install
. live-build
has extensive code to set up GRUB and other bootloaders. mkosi
uses grub-mkimage
.
It's the system build tool that is responsible for setting up the bootloader, which requires running bootloader installation commands.
{{quotation
|quote=Don't call grub-install on fresh install of grub-pc. It's the job of installers to do that after a fresh install.
|context=[https://metadata.ftp-master.debian.org/changelogs//main/g/grub2/grub2_2.12-5_changelog grub2
package, Debian changelog, Colin Watson Nov 2020]
}}
== grub-cloud package ==
{{Quotation
|quote=You don't want to use this package outside of cloud images.
|context=[https://packages.debian.org/bookworm/grub-cloud-amd64 grub-cloud-amd64
package, Debian]
}}
grub-cloud-amd64
package and /etc/default/grub
file inclusion:
{{Quotation
|quote=/etc/default/grub
|context=[https://packages.debian.org/bookworm/amd64/grub-cloud-amd64/filelist List of files]
}}
Source code references:
* [https://salsa.debian.org/cloud-team/grub-cloud grub-cloud source code]
* [https://salsa.debian.org/cloud-team/grub-cloud/-/blob/main/etc-default-amd64/grub?ref_type=heads AMD64 /etc/default/grub
]
* [https://salsa.debian.org/cloud-team/grub-cloud/-/blob/main/etc-default-arm64/grub?ref_type=heads ARM64 /etc/default/grub
]
* [https://salsa.debian.org/cloud-team/grub-cloud/-/blob/main/debian/grub-cloud-amd64.postinst?ref_type=heads AMD64 postinst
]
* [https://salsa.debian.org/cloud-team/grub-cloud/-/blob/main/debian/grub-cloud-arm64.postinst?ref_type=heads ARM64 postinst
]
AMD64 /etc/default/grub
contents:
# If you change this file, run 'update-grub' afterwards to update # /boot/grub/grub.cfg. # For full documentation of the options in this file, see: # info -f grub -n 'Simple configuration' GRUB_DEFAULT=0 GRUB_TIMEOUT=5 GRUB_DISTRIBUTOR=`lsb_release -i -s 2> /dev/null || echo Debian` GRUB_CMDLINE_LINUX_DEFAULT="" GRUB_CMDLINE_LINUX="console=tty0 console=ttyS0,115200 earlyprintk=ttyS0,115200 consoleblank=0" GRUB_TERMINAL_OUTPUT="gfxterm serial" GRUB_SERIAL_COMMAND="serial --speed=115200"* Potential issues with
grub-cloud
managing /etc/default/grub
:
** Running debsums --changed --config
would list /etc/default/grub
as a changed configuration file.
** Setting GRUB_CMDLINE_LINUX="console=tty0 console=ttyS0,115200 earlyprintk=ttyS0,115200 consoleblank=0"
can cause issues:
*** Security concerns?
*** Systemd log spam inside VirtualBox:
serial-getty@ttyS0.service: Succeeded. serial-getty@ttyS0.service: Service RestartSec=100ms expired, scheduling restart. serial-getty@ttyS0.service: Scheduled restart job, restart counter is at 625. Stopped Serial Getty on ttyS0. Started Serial Getty on ttyS0. /dev/ttyS0: not a tty serial-getty@ttyS0.service: Succeeded. serial-getty@ttyS0.service: Service RestartSec=100ms expired, scheduling restart. serial-getty@ttyS0.service: Scheduled restart job, restart counter is at 626. Stopped Serial Getty on ttyS0. Started Serial Getty on ttyS0. /dev/ttyS0: not a tty* VirtualBox: Adding a virtual disconnected serial console does not help either. This causes: ** GRUB boot menu becoming invisible. ** No console output for a long time. ** Extremely slow boot times. The serial console-related issues were encountered ~5 years ago when considering "why not enable a serial console by default inside VM images." * Possible solution: If using a
grub-cloud
-based solution, it may be better to undo the serial console setup.
* Architectural limitations: grub-cloud
currently supports only a limited set of architectures (Intel/AMD64 and ARM64 at the time of writing). Depending on your plans for multi-architecture support (as Debian is the universal operating system), this may be a limitation.
grub-cloud
also does not solve co-installation of grub-pc and grub-efi
Quote [https://salsa.debian.org/cloud-team/grub-cloud/-/blob/main/debian/control?ref_type=heads debian/control
file]
Package: grub-cloud-amd64 ... Depends: ${misc:Depends}, grub2-common (>= 2.02+dfsg1-7), grub-efi-amd64-bin, grub-efi-amd64-signed, grub-pc-bin, shim-signedAnalysis: *
grub-cloud
also only Depends:
on grub-pc-bin
but not on grub-pc
. Hence, grub-cloud
would also suffer from missing grub-pc
bootloader updates.
* grub-cloud
also only Depends:
on grub-efi-amd64-bin, grub-efi-amd64-signed
. It fails to Depends:
on grub-efi-amd64
. Hence, grub-cloud
would also suffer from missing grub-efi
bootloader updates.
Conclusion:
* grub-cloud
won't be helpful for fixing this issue.
* A perfect solution is impossible until Debian implements the feature request for grub-pc
and grub-efi
co-installability: [Allow concurrent installation of grub-pc and grub-efi-amd64](https://bugs-devel.debian.org/cgi-bin/bugreport.cgi?bug=904062).
* grub-cloud
seems like a worse solution than the implementation being suggested here in grml-debootstrap pull request [https://github.com/grml/grml-debootstrap/pull/299 Make bootloader updates on UEFI-based systems work].
Related Debian bug report:
* [https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1094977 grub-cloud-amd64: Ships /etc/default/grub, which installers need to be able to modify]
* [https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1094977 grub-cloud-amd64: not co-installable with grub-pc due to incompatible /etc/default/grub handling]
== GRUB Debian ==
* Debian for grub-pc with grub-efi co-install-ability feature request: [https://bugs-devel.debian.org/cgi-bin/bugreport.cgi?bug=904062 Allow concurrent installation of grub-pc and grub-efi-amd64]
= GRUB Upstream =
== GRUB Slow Upstream ==
{{quotation
|quote=We all know and love GRUB2. It is a good boot loader. It is also big, complex, rich, massive and tends to move slow on the development side.
|context=openSUSE blog post [https://news.opensuse.org/2023/12/20/systemd-fde/ Systemd-boot and Full Disk Encryption in Tumbleweed and MicroOS] talking about their motivation to add support for systemd-boot
}}
{{quotation
|quote=The openSUSE package for this boot loader contains more than 200 patches. Some of those patches are there for the last 5, 6 … 10 years. That is both an indication of the talent of the maintainers, but also can signal an issue in how slow the upstream contribution process can be.
|context=openSUSE blog post [https://news.opensuse.org/2023/12/20/systemd-fde/ Systemd-boot and Full Disk Encryption in Tumbleweed and MicroOS] talking about their motivation to add support for systemd-boot
}}
== GRUB Feature Richness ==
{{quotation
|quote=GRUB2 supports all the relevant systems, including mainframes, arm or powerpc. Multiple types of file systems, including btrfs or NTFS. It contains a full network stack, an USB stack, a terminal, can be scripted … In some sense, it is almost a mini OS by itself.
|context=openSUSE blog post [https://news.opensuse.org/2023/12/20/systemd-fde/ Systemd-boot and Full Disk Encryption in Tumbleweed and MicroOS] talking about their motivation to add support for systemd-boot
}}
== GRUB Full Disk Encryption ==
{{quotation
|quote=Kicksecure doesn’t use GRUB to unlock encrypted disks. This is because we use Debian’s GRUB, and Debian’s GRUB only has very bad LUKS support (only supports LUKS1, can’t handle non-US keyboard layouts, ugly, slow, only gives you one shot to unlock the drive, and then the Linux kernel has to unlock the drive again once it boots). Instead, we use an unencrypted /boot partition and let the initramfs handle decrypt. This lets us use more secure encryption, provides a better user interface for decryption, works with multiple keyboard layouts, and works faster.
|context=https://forums.kicksecure.com/t/installing-fde-luks-with-detached-luks-header-option/907/2
}}
See also:
* [https://forums.kicksecure.com/t/iso-change-to-unencrypted-boot-if-using-full-disk-encryption/420 ISO: Change to unencrypted /boot if using Full Disk Encryption]
= Calamares =
* [https://github.com/calamares/calamares/pull/2422 Prototype implementation of BIOS+UEFI boot support]
= Multiple Bootloader Maintenance Burden =
{{quotation
|quote=Supporting another boot loader comes with a cost.
|context=openSUSE blog post [https://news.opensuse.org/2023/12/20/systemd-fde/ Systemd-boot and Full Disk Encryption in Tumbleweed and MicroOS] talking about their motivation to add support for systemd-boot
}}
= systemd-boot =
== systemd-boot Limited Architecture Support ==
At time of writing, systemd-boot as can be soon on https://packages.debian.org/testing/systemd-boot supported only the following architectures:
amd64
arm64
armhf
i386
riscv64
= misc =
* https://wiki.archlinux.org/title/Talk:GRUB#Custom_keyboard_layout
* https://cryptsetup-team.pages.debian.net/cryptsetup/encrypted-boot.html
= keyboard layout issue =
* https://github.com/calamares/calamares/issues/1772
* https://github.com/calamares/calamares/issues/1726
* https://github.com/calamares/calamares/issues/1203
* https://superuser.com/questions/974833/change-the-keyboard-layout-of-grub-in-stage-1
* https://cryptsetup-team.pages.debian.net/cryptsetup/encrypted-boot.html
= grub config file - calamares - grub unlocks full disk encrypted hard drive =
# # DO NOT EDIT THIS FILE # # It is automatically generated by grub-mkconfig using templates # from /etc/grub.d and settings from /etc/default/grub # ### BEGIN /etc/grub.d/00_header ### if [ -s $prefix/grubenv ]; then set have_grubenv=true load_env fi if [ "${next_entry}" ] ; then set default="${next_entry}" set next_entry= save_env next_entry set boot_once=true else set default="0" fi if [ x"${feature_menuentry_id}" = xy ]; then menuentry_id_option="--id" else menuentry_id_option="" fi export menuentry_id_option if [ "${prev_saved_entry}" ]; then set saved_entry="${prev_saved_entry}" save_env saved_entry set prev_saved_entry= save_env prev_saved_entry set boot_once=true fi function savedefault { if [ -z "${boot_once}" ]; then saved_entry="${chosen}" save_env saved_entry fi } function load_video { if [ x$feature_all_video_module = xy ]; then insmod all_video else insmod efi_gop insmod efi_uga insmod ieee1275_fb insmod vbe insmod vga insmod video_bochs insmod video_cirrus fi } if [ x$feature_default_font_path = xy ] ; then font=unicode else insmod part_msdos insmod cryptodisk insmod luks insmod gcry_rijndael insmod gcry_rijndael insmod gcry_sha256 insmod ext2 cryptomount -u bbbe98fd58fa4ab9ba3418f1c2e72c94 set root='cryptouuid/bbbe98fd58fa4ab9ba3418f1c2e72c94' if [ x$feature_platform_search_hint = xy ]; then search --no-floppy --fs-uuid --set=root --hint='cryptouuid/bbbe98fd58fa4ab9ba3418f1c2e72c94' bdad388c-f3f2-4f53-9f70-04efe2bc60eb else search --no-floppy --fs-uuid --set=root bdad388c-f3f2-4f53-9f70-04efe2bc60eb fi font="/usr/share/grub/unicode.pf2" fi if loadfont $font ; then set gfxmode=auto load_video insmod gfxterm set locale_dir=$prefix/locale set lang=en_US insmod gettext fi terminal_output gfxterm if [ "${recordfail}" = 1 ] ; then set timeout=30 else if [ x$feature_timeout_style = xy ] ; then set timeout_style=menu set timeout=5 # Fallback normal timeout code in case the timeout_style feature is # unavailable. else set timeout=5 fi fi ### END /etc/grub.d/00_header ### ### BEGIN /etc/grub.d/05_debian_theme ### insmod part_msdos insmod cryptodisk insmod luks insmod gcry_rijndael insmod gcry_rijndael insmod gcry_sha256 insmod ext2 cryptomount -u bbbe98fd58fa4ab9ba3418f1c2e72c94 set root='cryptouuid/bbbe98fd58fa4ab9ba3418f1c2e72c94' if [ x$feature_platform_search_hint = xy ]; then search --no-floppy --fs-uuid --set=root --hint='cryptouuid/bbbe98fd58fa4ab9ba3418f1c2e72c94' bdad388c-f3f2-4f53-9f70-04efe2bc60eb else search --no-floppy --fs-uuid --set=root bdad388c-f3f2-4f53-9f70-04efe2bc60eb fi insmod png if background_image /usr/share/desktop-base/emerald-theme/grub/grub-4x3.png; then set color_normal=white/black set color_highlight=black/white else set menu_color_normal=cyan/blue set menu_color_highlight=white/blue fi ### END /etc/grub.d/05_debian_theme ### ### BEGIN /etc/grub.d/10_linux ### function gfxmode { set gfxpayload="${1}" } set linux_gfx_mode= export linux_gfx_mode menuentry 'Debian GNU/Linux' --class debian --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-simple-bdad388c-f3f2-4f53-9f70-04efe2bc60eb' { load_video insmod gzio if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi insmod part_msdos insmod cryptodisk insmod luks insmod gcry_rijndael insmod gcry_rijndael insmod gcry_sha256 insmod ext2 cryptomount -u bbbe98fd58fa4ab9ba3418f1c2e72c94 set root='cryptouuid/bbbe98fd58fa4ab9ba3418f1c2e72c94' if [ x$feature_platform_search_hint = xy ]; then search --no-floppy --fs-uuid --set=root --hint='cryptouuid/bbbe98fd58fa4ab9ba3418f1c2e72c94' bdad388c-f3f2-4f53-9f70-04efe2bc60eb else search --no-floppy --fs-uuid --set=root bdad388c-f3f2-4f53-9f70-04efe2bc60eb fi echo 'Loading Linux 6.1.0-9-amd64 ...' linux /boot/vmlinuz-6.1.0-9-amd64 root=UUID=bdad388c-f3f2-4f53-9f70-04efe2bc60eb ro quiet cryptdevice=UUID=bbbe98fd-58fa-4ab9-ba34-18f1c2e72c94:luks-bbbe98fd-58fa-4ab9-ba34-18f1c2e72c94 root=/dev/mapper/luks-bbbe98fd-58fa-4ab9-ba34-18f1c2e72c94 splash resume=/dev/mapper/luks-e17af10a-e7fc-489c-943f-1713e5ad292a echo 'Loading initial ramdisk ...' initrd /boot/initrd.img-6.1.0-9-amd64 } submenu 'Advanced options for Debian GNU/Linux' $menuentry_id_option 'gnulinux-advanced-bdad388c-f3f2-4f53-9f70-04efe2bc60eb' { menuentry 'Debian GNU/Linux, with Linux 6.1.0-9-amd64' --class debian --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-6.1.0-9-amd64-advanced-bdad388c-f3f2-4f53-9f70-04efe2bc60eb' { load_video insmod gzio if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi insmod part_msdos insmod cryptodisk insmod luks insmod gcry_rijndael insmod gcry_rijndael insmod gcry_sha256 insmod ext2 cryptomount -u bbbe98fd58fa4ab9ba3418f1c2e72c94 set root='cryptouuid/bbbe98fd58fa4ab9ba3418f1c2e72c94' if [ x$feature_platform_search_hint = xy ]; then search --no-floppy --fs-uuid --set=root --hint='cryptouuid/bbbe98fd58fa4ab9ba3418f1c2e72c94' bdad388c-f3f2-4f53-9f70-04efe2bc60eb else search --no-floppy --fs-uuid --set=root bdad388c-f3f2-4f53-9f70-04efe2bc60eb fi echo 'Loading Linux 6.1.0-9-amd64 ...' linux /boot/vmlinuz-6.1.0-9-amd64 root=UUID=bdad388c-f3f2-4f53-9f70-04efe2bc60eb ro quiet cryptdevice=UUID=bbbe98fd-58fa-4ab9-ba34-18f1c2e72c94:luks-bbbe98fd-58fa-4ab9-ba34-18f1c2e72c94 root=/dev/mapper/luks-bbbe98fd-58fa-4ab9-ba34-18f1c2e72c94 splash resume=/dev/mapper/luks-e17af10a-e7fc-489c-943f-1713e5ad292a echo 'Loading initial ramdisk ...' initrd /boot/initrd.img-6.1.0-9-amd64 } menuentry 'Debian GNU/Linux, with Linux 6.1.0-9-amd64 (recovery mode)' --class debian --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-6.1.0-9-amd64-recovery-bdad388c-f3f2-4f53-9f70-04efe2bc60eb' { load_video insmod gzio if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi insmod part_msdos insmod cryptodisk insmod luks insmod gcry_rijndael insmod gcry_rijndael insmod gcry_sha256 insmod ext2 cryptomount -u bbbe98fd58fa4ab9ba3418f1c2e72c94 set root='cryptouuid/bbbe98fd58fa4ab9ba3418f1c2e72c94' if [ x$feature_platform_search_hint = xy ]; then search --no-floppy --fs-uuid --set=root --hint='cryptouuid/bbbe98fd58fa4ab9ba3418f1c2e72c94' bdad388c-f3f2-4f53-9f70-04efe2bc60eb else search --no-floppy --fs-uuid --set=root bdad388c-f3f2-4f53-9f70-04efe2bc60eb fi echo 'Loading Linux 6.1.0-9-amd64 ...' linux /boot/vmlinuz-6.1.0-9-amd64 root=UUID=bdad388c-f3f2-4f53-9f70-04efe2bc60eb ro single echo 'Loading initial ramdisk ...' initrd /boot/initrd.img-6.1.0-9-amd64 } } ### END /etc/grub.d/10_linux ### ### BEGIN /etc/grub.d/20_linux_xen ### ### END /etc/grub.d/20_linux_xen ### ### BEGIN /etc/grub.d/30_os-prober ### ### END /etc/grub.d/30_os-prober ### ### BEGIN /etc/grub.d/30_uefi-firmware ### ### END /etc/grub.d/30_uefi-firmware ### ### BEGIN /etc/grub.d/40_custom ### # This file provides an easy way to add custom menu entries. Simply type the # menu entries you want to add after this comment. Be careful not to change # the 'exec tail' line above. ### END /etc/grub.d/40_custom ### ### BEGIN /etc/grub.d/41_custom ### if [ -f ${config_directory}/custom.cfg ]; then source ${config_directory}/custom.cfg elif [ -z "${config_directory}" -a -f $prefix/custom.cfg ]; then source $prefix/custom.cfg fi ### END /etc/grub.d/41_custom ###= dracut bug log = Debian bug report: [https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1041614 unbootable system after installing dracut on a standard Debian installation]
sudo dracut -f
dracut: Executing: /usr/bin/dracut -f dracut: dracut module 'mksh' will not be installed, because command 'mksh' could not be found! dracut: dracut module 'systemd-coredump' will not be installed, because command 'coredumpctl' could not be found! dracut: dracut module 'systemd-coredump' will not be installed, because command '/usr/lib/systemd/systemd-coredump' could not be found! dracut: dracut module 'systemd-portabled' will not be installed, because command 'portablectl' could not be found! dracut: dracut module 'systemd-portabled' will not be installed, because command '/usr/lib/systemd/systemd-portabled' could not be found! dracut: dracut module 'systemd-resolved' will not be installed, because command 'resolvectl' could not be found! dracut: dracut module 'systemd-resolved' will not be installed, because command '/usr/lib/systemd/systemd-resolved' could not be found! dracut: dracut module 'systemd-timesyncd' will not be installed, because command '/usr/lib/systemd/systemd-timesyncd' could not be found! dracut: dracut module 'dbus-broker' will not be installed, because command 'dbus-broker' could not be found! dracut: dracut module 'rngd' will not be installed, because command 'rngd' could not be found! dracut: dracut module 'lvmmerge' will not be installed, because command 'lvm' could not be found! dracut: dracut module 'lvmthinpool-monitor' will not be installed, because command 'lvm' could not be found! dracut: dracut module 'dmraid' will not be installed, because command 'dmraid' could not be found! dracut: dracut module 'lvm' will not be installed, because command 'lvm' could not be found! dracut: dracut module 'mdraid' will not be installed, because command 'mdadm' could not be found! dracut: dracut module 'multipath' will not be installed, because command 'multipath' could not be found! dracut: dracut module 'pcsc' will not be installed, because command 'pcscd' could not be found! dracut: dracut module 'tpm2-tss' will not be installed, because command 'tpm2' could not be found! dracut: dracut module 'nvmf' will not be installed, because command 'nvme' could not be found! dracut: dracut module 'biosdevname' will not be installed, because command 'biosdevname' could not be found! dracut: dracut module 'memstrack' will not be installed, because command 'memstrack' could not be found! dracut: memstrack is not available dracut: If you need to use rd.memdebug>=4, please install memstrack and procps-ng dracut: *** Including module: systemd *** dracut: *** Including module: systemd-initrd *** dracut: *** Including module: modsign *** dracut: *** Including module: console-setup *** dracut: *** Including module: i18n *** dracut: *** Including module: drm *** dracut: *** Including module: plymouth *** dracut: *** Including module: btrfs *** dracut: *** Including module: crypt *** dracut: *** Including module: dm *** dracut: Skipping udev rule: 10-dm.rules dracut: Skipping udev rule: 13-dm-disk.rules dracut: Skipping udev rule: 64-device-mapper.rules dracut: *** Including module: kernel-modules *** dracut: *** Including module: kernel-modules-extra *** dracut: *** Including module: nvdimm *** dracut: *** Including module: overlay-root *** dracut: *** Including module: qemu *** dracut: *** Including module: lunmask *** dracut: *** Including module: resume *** dracut: *** Including module: rootfs-block *** dracut: *** Including module: terminfo *** dracut: *** Including module: udev-rules *** dracut: Skipping udev rule: 40-redhat.rules dracut: Skipping udev rule: 91-permissions.rules dracut: Skipping udev rule: 80-drivers-modprobe.rules dracut: *** Including module: virtiofs *** dracut: *** Including module: dracut-systemd *** dracut: *** Including module: usrmount *** dracut: *** Including module: base *** dracut: *** Including module: fs-lib *** dracut: *** Including module: shutdown *** dracut: *** Including modules done *** dracut: *** Installing kernel module dependencies *** dracut: *** Installing kernel module dependencies done *** dracut: *** Resolving executable dependencies *** dracut: *** Resolving executable dependencies done *** dracut: *** Hardlinking files *** dracut: Mode: real dracut: Method: sha256 dracut: Files: 2226 dracut: Linked: 211 files dracut: Compared: 0 xattrs dracut: Compared: 3762 files dracut: Saved: 18.82 MiB dracut: Duration: 0.203010 seconds dracut: *** Hardlinking files done *** dracut: *** Generating early-microcode cpio image *** dracut: *** Constructing AuthenticAMD.bin *** dracut: *** Constructing GenuineIntel.bin *** dracut: *** Store current command line parameters *** dracut: *** Stripping files *** dracut: *** Stripping files done *** dracut: *** Creating image file '/boot/initrd.img-6.1.0-10-amd64' *** dracut: Using auto-determined compression method 'gzip' dracut: *** Creating initramfs image file '/boot/initrd.img-6.1.0-10-amd64' done ***= Footnotes = {{Footer}} [[Category:Development]]