Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[SOLVED] boot freeze (EFI, fulldisk luks decryption)
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Installing Gentoo
View previous topic :: View next topic  
Author Message
freifunk_connewitz
Apprentice
Apprentice


Joined: 08 Feb 2006
Posts: 196

PostPosted: Fri Nov 01, 2019 5:35 pm    Post subject: [SOLVED] boot freeze (EFI, fulldisk luks decryption) Reply with quote

Hi,

On a new ultrabook I try to install Gentoo according to Sakaki's great guide: dual boot with Win10, fully encrypted etc. (https://wiki.gentoo.org/wiki/Sakaki%27s_EFI_Install_Guide)

After the first installation round, when it comes to the first boot of the newly installed Gentoo, the boot process crashes:
- first, the Fujitsu logo screen sits there unusually long before booting starts
- first error: "WARNING:Failed to connect to lvmetad. Falling back to device scanning"
- then the boot process correctly identifies the encrypted root ("working on /dev/disk/by-partuuid/...") and tries to unlock it with the key file
- but it fails to locate or open the usb stick where the key file resides:
- first it asks for "Insert device... You have 10 seconds"
- then it tries to mount the HDD (NVMe) partitions, and dumps the error message of the missing key to decrypt the luks partition: "Could not find the root_[PARTUUIDof the Luks device]... key device [then follows the -correct!- PARTUUID of the usb stick partitition where the key is at]"
- then it tells me to issue 'shell' for a shell, 'Enter' for repeat, or 'q' for quit, but nothing happens if I do so, not even ctrl-alt-del works, I have to switch the laptop off with the power button.

It is almost the same problem as here: https://forums.gentoo.org/viewtopic-t-1073720-start-0.html.

The kernel command line parameters are those provided by the buildkernel-script from Sakakis overlay.

The stick is ok, I checked it with another computer. There I can also see the EFI kernel and config in their correct location, as the luks-key.gpg file. The PARTUUID of the stick when checked at the other computer is exactly the same as asked for by the boot process.

Secure Boot is off. For kernel compilation I used Sakakis standard options. buildkernel is version 1.0.35

EDIT: Even when I discard the whole USB drive / keyfile mechanism and install the kernel via the buildkernel utility onto the EFI system partition on the harddrive: the error persists. Booting freezes as soon as it comes to ask for the password for the LUKS encrypted root.

Can it be a hardware problem / laptop too new? It's a Fujitsu U 939. At least, the Gentoo Live USB medium completely failed to boot the machine (blank screen). I had to use RescueCD 6.0.3 to be able to start the Gentoo installation. Unfortunately, I have no idea which component failed the Gentoo Live System.

Your help is very much appreciated.


Last edited by freifunk_connewitz on Tue Nov 05, 2019 3:36 pm; edited 1 time in total
Back to top
View user's profile Send private message
etnull
Guru
Guru


Joined: 26 Mar 2019
Posts: 327

PostPosted: Sat Nov 02, 2019 1:59 pm    Post subject: Reply with quote

Such complex installations are very difficult to debug and assist you in solving your problem. The only thing I can suggest you is to start with much simpler setup, no dual boot, no lvm, no gpg, only LUKS encryption, a keyfile and a custom made initramfs. This way you can decipher the complexity and understand what does what in such installation (because tools like genkernel hide a lot from you). After you succeed in base encrypted install you can add lvm and more complexity on top of that, but still stay away from gpg, it's not really necessary, you can make your keyfile from /dev/random, put it on an encrypted /boot partition and use this keyfile to decrypt the rest of the drives, it will be less susceptible to errors due to gpg versions etc.
Back to top
View user's profile Send private message
freifunk_connewitz
Apprentice
Apprentice


Joined: 08 Feb 2006
Posts: 196

PostPosted: Sat Nov 02, 2019 4:16 pm    Post subject: Reply with quote

Thank you, etnull, for your answer. I've already cut back complexity in dropping gpg and moving the kernel to the EFI partition on HDD instead of the USB stick. I will try to break away from Sakaki's guide and tools here and try to bake a normal kernel and initramfs using genkernel - and probably using Grub. EFI alone (I had bad experiences with it on another machine already) seems to be unreliable to me when it comes to dual boot of Win and Gentoo. But unfortunately it is not an option to delete the Windows partition, I'm gonna need it about twice a year.

I'm still wondering why the Gentoo install medium failed to boot my laptop (while Arch/RescueCD and Ubuntu succeeded). Does nobody else have such problems? The hardware is not that exotic - almost everything Intel: CPU, GPU, net, wifi, PCI, NVMe...
Back to top
View user's profile Send private message
Hu
Moderator
Moderator


Joined: 06 Mar 2007
Posts: 15294

PostPosted: Sat Nov 02, 2019 5:05 pm    Post subject: Reply with quote

freifunk_connewitz wrote:
- first, the Fujitsu logo screen sits there unusually long before booting starts
Firmware is infamous for being slow. How long does it take to switch over to Linux? Once Linux starts printing text, how long until userspace starts?
freifunk_connewitz wrote:
- first error: "WARNING:Failed to connect to lvmetad. Falling back to device scanning"
That's a warning, not an error. It's probably not relevant.

Please provide the full output from this point in the boot on to where it goes interactive, with no paraphrasing or elision.
freifunk_connewitz wrote:
- then the boot process correctly identifies the encrypted root ("working on /dev/disk/by-partuuid/...") and tries to unlock it with the key file
- but it fails to locate or open the usb stick where the key file resides:
Why does it fail?
freifunk_connewitz wrote:
- first it asks for "Insert device... You have 10 seconds"
- then it tries to mount the HDD (NVMe) partitions, and dumps the error message of the missing key to decrypt the luks partition: "Could not find the root_[PARTUUIDof the Luks device]... key device [then follows the -correct!- PARTUUID of the usb stick partitition where the key is at]"
How do you know the USB key is there? Does the device exist?
freifunk_connewitz wrote:
- then it tells me to issue 'shell' for a shell, 'Enter' for repeat, or 'q' for quit, but nothing happens if I do so, not even ctrl-alt-del works, I have to switch the laptop off with the power button.
That sounds like an initramfs problem.
Back to top
View user's profile Send private message
freifunk_connewitz
Apprentice
Apprentice


Joined: 08 Feb 2006
Posts: 196

PostPosted: Sat Nov 02, 2019 5:55 pm    Post subject: Reply with quote

Hu wrote:
freifunk_connewitz wrote:
- first, the Fujitsu logo screen sits there unusually long before booting starts
Firmware is infamous for being slow. How long does it take to switch over to Linux? Once Linux starts printing text, how long until userspace starts?

the logo screen takes about 7 sec until Linux starts.

Hu wrote:
Please provide the full output from this point in the boot on to where it goes interactive, with no paraphrasing or elision.

I have to manually write it down from the affected machine's screen, from the very first line on:
Code:
>> Activating udev
>> Loading modules
:: Loading from {and now follow lines for each: pata, sata, scsi, usb, firewire, waitscan, dmraid, mdadm, fs, net, iscsi, crypto, virtio, lvm}:
>> Activating Logical Volume Groups
 WARNING: Failed to connect to lvmetad. Falling back to device scanning.
>> Loading keyboard mappings.
>> Loading the ''de'' keyboard mapping.
>> Working on device /dev/disk/by-partuuid/5c{...}ee...
Enter passphrase for /dev/disk/by-partuuid/5c{...}ee:


And there it freezes. I can enter anything, the machine does not react anymore, except to switching it off physically.

The description differs a bit from the OP because I moved away from a keyfile on usb stick and installed kernel and initrd to the EFI system partition on the HDD.

Hu wrote:
freifunk_connewitz wrote:
- but it fails to locate or open the usb stick where the key file resides:
Why does it fail?
freifunk_connewitz wrote:
- first it asks for "Insert device... You have 10 seconds"
- then it tries to mount the HDD (NVMe) partitions, and dumps the error message of the missing key to decrypt the luks partition: "Could not find the root_[PARTUUIDof the Luks device]... key device [then follows the -correct!- PARTUUID of the usb stick partitition where the key is at]"
How do you know the USB key is there? Does the device exist?

When I tried that USB key approach, the whole boot process started from the USB device, according to Sakaki's guide. That's where it got the kernel from and the PARTUUIDs where to look for key file and luks root partition. And the keymap info. That's why I assume it still should be available to the kernel.

Hu wrote:
freifunk_connewitz wrote:
- then it tells me to issue 'shell' for a shell, 'Enter' for repeat, or 'q' for quit, but nothing happens if I do so, not even ctrl-alt-del works, I have to switch the laptop off with the power button.
That sounds like an initramfs problem.

Thanks for the hint. I'm gonna try to rebuild kernel and initramfs the standard handbook way, install it to the ESP, along with GRUB, and see if this is able to boot without freezing. And to find and decrypt the LUKS root partition.
Back to top
View user's profile Send private message
Hu
Moderator
Moderator


Joined: 06 Mar 2007
Posts: 15294

PostPosted: Sat Nov 02, 2019 7:13 pm    Post subject: Reply with quote

Since the system does not react to entering the passphrase, I should ask: does the system know it has a keyboard? If your keyboard is not supported by your kernel, nothing you type will have any effect.

When using an external USB key, anything done by the bootloader is irrelevant to the kernel. The kernel may not be able to access the USB key, even if the bootloader could.
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 45383
Location: 56N 3W

PostPosted: Sat Nov 02, 2019 7:24 pm    Post subject: Reply with quote

freifunk_connewitz,

Code:
- then the boot process correctly identifies the encrypted root ("working on /dev/disk/by-partuuid/...") and tries to unlock it with the key file
- but it fails to locate or open the usb stick where the key file resides:


The kernel normally mounts root before starting the USB subsystem. Add either
Code:
rootdelay=10
to allow 10 seconds for USB to be started or rootwait to wait forever for root to appear, to the kernel command line. rootdelay= is better for debug because if root isn't there when the timeout expires, the kernel goes on to panic.
You need USB to be able to mount root


/dev/disk/by-partuuid/ is not safe as its a symlink. Something needs to create the link.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
freifunk_connewitz
Apprentice
Apprentice


Joined: 08 Feb 2006
Posts: 196

PostPosted: Sun Nov 03, 2019 11:35 am    Post subject: Reply with quote

NeddySeagoon wrote:

/dev/disk/by-partuuid/ is not safe as its a symlink. Something needs to create the link.


Ok, changed to /dev/nvme0n1p5 which is the dev name.

Hu wrote:
Since the system does not react to entering the passphrase, I should ask: does the system know it has a keyboard? If your keyboard is not supported by your kernel, nothing you type will have any effect.


Oops. Did not think of that. How would I know? I'll double check kernel config.

However, I installed Grub and initramfs via genkernel. Grub loads successfully, when I start it, the new screen shows:
Code:

Loading kernel 4.19.72-gentoo-lts ...
Loading initramfs...


and then it halts as before... So it really seems to be a problem with the initramdisk. Am I correct that it fails before even coming to lvm or cryptsetup?
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 45383
Location: 56N 3W

PostPosted: Sun Nov 03, 2019 11:43 am    Post subject: Reply with quote

freifunk_connewitz,

Code:
Loading kernel 4.19.72-gentoo-lts ...
Loading initramfs...
are the last messages from grub.

The kernels first message is "Decompressing Linux ..."
You may not see that for several reasons, mostly because it keeps getting faster.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
freifunk_connewitz
Apprentice
Apprentice


Joined: 08 Feb 2006
Posts: 196

PostPosted: Sun Nov 03, 2019 7:02 pm    Post subject: Reply with quote

Neddy Seagoon,

Quote:

Code:
Loading kernel 4.19.72-gentoo-lts ...
Loading initramfs...
are the last messages from grub.

The kernels first message is "Decompressing Linux ..."
You may not see that for several reasons, mostly because it keeps getting faster.


Sorry, I don't understand. Who is getting faster? There really are no other messages after I start the boot entry from the Grub menu. Nothing else flickers away, not even for a split second.

What else can I do? Can my problem be the kernel config? The base of the configuration was the builtin config of RescueCDs kernel, which is heavily modularized, so I changed quite a few entries from M to Y in it (e.g. for ext4).
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 45383
Location: 56N 3W

PostPosted: Sun Nov 03, 2019 7:46 pm    Post subject: Reply with quote

freifunk_connewitz,

20 years ago, the "Decompressing Linux ..." was on the screen for several seconds.
As hardware has got faster, so that message has become briefer.

Don't assume that because you don't see it, its not there.
Its also possible that the kernel cannot drive the console until that message has come and gone.

Please post the output of
Code:
lspci -nnk
so we can see your hardware and drivers in use.
Put your kernel .config onto a pastebin and post a link. Its far too big for a post.
wgetpaste can help.

The content of grub.cfg will be useful too.

At the moment, I'm looking to get some debug information. That's all.
I suspect that it will want a kernel rebuild. It won't be a fix, just an attempt to get an early console so we can see what is going on.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
freifunk_connewitz
Apprentice
Apprentice


Joined: 08 Feb 2006
Posts: 196

PostPosted: Sun Nov 03, 2019 11:00 pm    Post subject: Reply with quote

Thank you, Neddy, for your suggestions. It indeed was a kernel configuration problem. I removed .config and went through makeconfig again, according to my hardware, rebuilt initram, run grub-mkconfig, rebooted and had a successfully booting kernel.

The next snag I hit was that Grub cannot handle my LUKS root partition because it's LUKS2-formatted. So I think I have to reformat that partition to LUKS1 and copy the backup onto it.
Back to top
View user's profile Send private message
etnull
Guru
Guru


Joined: 26 Mar 2019
Posts: 327

PostPosted: Sun Nov 03, 2019 11:13 pm    Post subject: Reply with quote

freifunk_connewitz wrote:

The next snag I hit was that Grub cannot handle my LUKS root partition because it's LUKS2-formatted. So I think I have to reformat that partition to LUKS1 and copy the backup onto it.

You can have LUKS1 /boot, to start things up, everything else can be LUKS2, I do it this way.
Back to top
View user's profile Send private message
freifunk_connewitz
Apprentice
Apprentice


Joined: 08 Feb 2006
Posts: 196

PostPosted: Tue Nov 05, 2019 3:35 pm    Post subject: Reply with quote

Summarizing for those who hit similar problems:

  • If you have to boot a new machine with a different Live system than Gentoo, e.g. RescueCD, or Ubuntu, (because Gentoo's minimal install won't boot) than take care when it comes to configuring your new kernel. Do not simply incorporate the kernel config of the running live-system kernel into your config. Rather start from scratch (without existing .config) or use the defaults from genkernel or the like.
  • If you want to install your new system with a LUKS full disk encryption double check if your booting kernel and tools will be able to decrypt the LUKS device/partition. My experience says to avoid LUKS2 when formatting your new LUKS container/device/partition. Use "--type luks1" while performing LuksFormat. In my case neither Grub (which is known and officially so) nor the EFI-kernel-including-initramfs method proposed by Sakaki's guide succeeded in opening my LUKS2-formatted partition. As soon I reformatted it as LUKS1, decryption worked.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Installing Gentoo All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum