CINXE.COM

<!DOCTYPE html> <html lang="en" dir="ltr"> <head> <meta charset="utf-8"> <meta name="generator" content="pandoc"> <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes">  <meta property="og:title" content="Libreboot – Linux guides"> <meta property="og:type" content="article" /> <meta property="og:image" content="https://av.vimuser.org/bootmenu.jpg"> <meta property="og:url" content="https://libreboot.org/docs/linux/"> <meta name="twitter:card" content="summary_large_image"> <meta property="og:description" content="Libreboot – Linux guides"> <meta property="og:site_name" content="Libreboot – Linux guides"> <meta name="twitter:image:alt" content="Libreboot – Linux guides"> <title>Libreboot – Linux guides</title> <link rel="stylesheet" href="/global.css"> <link rel="stylesheet" href=""> <link rel="alternate" type="application/rss+xml" title="RSS Feed" href="/feed.xml"/> </head> <body> <div class="page"> <header> <div class="title"> <p class="title-logo"> <img loading="lazy" class="title-logo" alt="Libreboot logo" src="/favicon.ico" /> </p> <h1 class="title">Linux guides</h1> </div> <ul> <li><a href="/">Home</a></li> <li><a href="/faq.html">FAQ</a></li> <li><a href="/download.html">Download</a></li> <li>-</li> <li style="font-size:1.3em;"><em><strong><a href="https://minifree.org/">Buy Libreboot preinstalled</a></strong></em></li> <li>-</li> <li><a href="/docs/install/">Install</a></li> <li><a href="/docs/">Docs</a></li> <li><a href="/news/">News</a></li> <li><a href="https://codeberg.org/libreboot/lbmk/issues">Bugs</a></li> <li><a href="/tasks/">TODO</a></li> <li><a href="/git.html">Send patch</a></li> <li><a href="/contact.html">Contact</a></li> <li>-</li> <li style="font-size:1.3em;"><em><strong><a href="https://www.patreon.com/libreleah">Donate</a></strong></em></li> </ul> <hr/> </header> <nav id="TOC"> <h1>Navigate this page:</h1> <ul> <li><a href="#useful-links">Useful links</a></li> <li><a href="#note-about-vga-modes-and-grub">NOTE ABOUT VGA MODES and GRUB</a></li> <li><a href="#encrypted-boot-via-luks2-with-argon2">Encrypted /boot via LUKS2 with argon2</a> <ul> <li><a href="#argon2id">argon2id</a></li> </ul></li> <li><a href="#rebooting-system-in-case-of-freeze">Rebooting system in case of freeze</a></li> <li><a href="#fedora-wont-boot">Fedora won’t boot?</a> <ul> <li><a href="#linux16-issue">linux16 issue</a></li> <li><a href="#bls-issue">BLS issue</a></li> </ul></li> </ul> </nav> <div class="pagetext"> <p><a href="../">Return to previous index</a></p> <p>NOTE: This guide pertains to x86 hosts, and does not cover supported CrOS/ARM chromebooks. For ARM targets, you should refer to u-boot documentation.</p> <p>This page is useful for those who wish to use the GRUB GRUB payload directly. If you’re using SeaBIOS, the boot process will work similarly to traditional BIOS systems; refer to the SeaBIOS documentation on <a href="https://seabios.org/SeaBIOS" class="uri">https://seabios.org/SeaBIOS</a></p> <p>Linux is generally assumed, especially for Libreboot development, but Libreboot also works quite nicely with <a href="../bsd/">BSD systems</a>.</p> <div class="h"><h1 id="useful-links">Useful links</h1><a aria-hidden="true" href="#useful-links">[link]</a></div> <p>Refer to the following pages:</p> <ul> <li><a href="grub_boot_installer.html">How to Prepare and Boot a USB Installer in libreboot Systems</a></li> <li><a href="grub_cbfs.html">Modifying the GRUB Configuration in libreboot Systems</a></li> <li><a href="grub_hardening.html">How to Harden Your GRUB Configuration, for Security</a></li> </ul> <div class="h"><h1 id="note-about-vga-modes-and-grub">NOTE ABOUT VGA MODES and GRUB</h1><a aria-hidden="true" href="#note-about-vga-modes-and-grub">[link]</a></div> <p>Libreboot does not support switching VGA modes, when coreboot’s libgfxinit is used on Intel GPUs. Many distros will install GRUB, which Libreboot then finds and executes, if running SeaBIOS payload; if using GRUB, just the distro’s grub.cfg file is loaded instead, by Libreboot’s own GRUB in flash.</p> <p>Libreboot GRUB boots in text mode or uses the coreboot framebuffer. Anyway, set <code>GRUB_TERMINAL=console</code> in GRUB and you should be fine. This avoids GRUB, the one provided by your distro, switching video modes.</p> <p>In Debian for example (steps largely the same on other distros):</p> <p>Edit <code>/etc/default/grub</code> as root, and uncomment or add the line:</p> <pre><code>GRUB_TERMINAL=console</code></pre> <p>Then still as root, do these commands:</p> <pre><code>export PATH="$PATH:/sbin" update-grub</code></pre> <p>NOTE: <code>update-grub</code> is very much Debian-centric. Not all distros will have it. On Arch-based distros for instance, you might do:</p> <pre><code>grub-mkconfig -o /boot/grub/grub.cfg</code></pre> <p>Now your distro’s GRUB menu should work, when your distro’s GRUB bootloader is executed from Libreboot’s SeaBIOS payload.</p> <div class="h"><h1 id="encrypted-boot-via-luks2-with-argon2">Encrypted /boot via LUKS2 with argon2</h1><a aria-hidden="true" href="#encrypted-boot-via-luks2-with-argon2">[link]</a></div> <p>Full encryption for basic LUKS2 (with PBKDF or argon2 key derivation) is supported in libreboot. Legacy LUKS1 is also supported. On <em>most</em> other systems, <code>/boot</code> must be unencrypted, but Libreboot supports use of the GRUB bootloader as a coreboot payload, directly in the boot flash.</p> <p>GRUB has code in it that can be used to unlock LUKS1 and LUKS2 dm-crypt, using the <code>cryptomount</code> command. With this, you can boot with <em>true</em> full disk encryption, by encrypting <code>/boot</code>.</p> <p>This is a boon for security, because it’s harder to tamper with, and you could potentially write-protect plus maybe provide a <a href="grub_hardening.html">password</a> in GRUB at boot time.</p> <p>The easiest way to use it is like this: in Linux, set up your partitions like you would, but use LVM volume groups, with group name <code>grubcrypt</code> and either:</p> <ul> <li><code>/</code> as volume name <code>rootvol</code> and <code>/boot</code> as volume name <code>bootvol</code></li> <li><code>/</code> as volume name <code>rootvol</code> and <code>/boot</code> exists within it (no <code>bootvol</code>)</li> </ul> <p>If your distro then installs GRUB, and provides a <code>grub.cfg</code> file under <code>/boot/grub</code> (within the distro, on your SSD/HDD file system), it should work. Libreboot’s GRUB will automatically give you a passphrase prompt, where you type your passphrase and it unlocks the volume. Then it will find your LVMs and it’ll boot from that.</p> <p>Otherwise, to manually unlock it, you drop to the GRUB shell with C and do:</p> <pre><code>cryptomount -a</code></pre> <p>Or on a specific device, e.g.</p> <pre><code>cryptomount (ahci0,1)</code></pre> <p>This is similar to <code>cryptsetup luksOpen</code> in Linux.</p> <p>Libreboot GRUB merges the PHC argon2 implementation, so it has full support for LUKS2 installations in addition to LUKS1. Libreboot 20231021 and higher has argon2 support, but older releases only supported PBKDF2 which would make LUKS2 dysfunctional unless you swapped it to use PBKDF2 (not argon2) and/or downgraded to LUKS1.</p> <p>With modern Libreboot, you can just use LUKS2 as-is, on most/all Linux distros. At the time of the Libreboot 20231021 release, the GRUB upstream (on gnu.org) did not have these argon2 patches in its source tree, but Libreboot merges and maintains them out of tree.</p> <div class="h"><h2 id="argon2id">argon2id</h2><a aria-hidden="true" href="#argon2id">[link]</a></div> <p>You should <em>specifically</em> use argon2id. Please ensure this, because some older LUKS2 setups defaulted to the weaker <em>argon2i</em>. This post by Matthew Garret contains information about that:</p> <p><a href="https://mjg59.dreamwidth.org/66429.html" class="uri">https://mjg59.dreamwidth.org/66429.html</a></p> <p>NOTE: You should also read the instructions about about <code>GRUB_TERMINAL</code>.</p> <div class="h"><h1 id="rebooting-system-in-case-of-freeze">Rebooting system in case of freeze</h1><a aria-hidden="true" href="#rebooting-system-in-case-of-freeze">[link]</a></div> <p>Linux kernel has a feature to do actions to the system any time, even with it freezes, this is called a <a href="https://en.wikipedia.org/wiki/Reisub">Magic SysRq keys</a>. You can do these actions with Alt + Sysrq + Command. These are the actions:</p> <ul> <li>Alt + SysRq + B: Reboot the system</li> <li>Alt + SysRq + I: Send SIGKILL to every process except PID 1</li> <li>Alt + SysRq + O: Shut off the system</li> </ul> <p>If some of them don’t work, you have to enable it in the kernel command line paramter. So append <code>sysrq_always_enabled=1</code> to your <code>GRUB_CMDLINE_LINUX_DEFAULT</code> in <code>/etc/default/grub</code></p> <p>You can also run <code># sysctl kernel.sysrq=1</code> to enable them.</p> <div class="h"><h1 id="fedora-wont-boot">Fedora won’t boot?</h1><a aria-hidden="true" href="#fedora-wont-boot">[link]</a></div> <p>This may also apply to CentOS or Redhat. Chroot guide can be found on <a href="https://docs.fedoraproject.org/en-US/quick-docs/bootloading-with-grub2/#restoring-bootloader-using-live-disk">fedora website</a></p> <div class="h"><h2 id="linux16-issue">linux16 issue</h2><a aria-hidden="true" href="#linux16-issue">[link]</a></div> <p>Libreboot’s default GRUB config sources fedora’s grub config <code>grub.cfg</code> (in <code>/boot/grub2/grub.cfg</code>), fedora by default makes use of the <code>linux16</code> command, where it should be saying <code>linux</code></p> <p>Do this in fedora:</p> <p>Open <code>/etc/grub.d/10_linux</code></p> <p>Set the <code>sixteenbit</code> variable to an empty string, then run:</p> <pre><code>grub2-mkconfig -o /boot/grub2/grub.cfg</code></pre> <div class="h"><h2 id="bls-issue">BLS issue</h2><a aria-hidden="true" href="#bls-issue">[link]</a></div> <p>With <a href="https://fedoraproject.org/wiki/Changes/BootLoaderSpecByDefault">newer versions of fedora</a>, scripts from grub package default to generating <a href="https://www.freedesktop.org/wiki/Specifications/BootLoaderSpec/">BLS</a> instead of <code>grub.cfg</code>. To change that behaviour add following line to <code>/etc/default/grub</code> (or modify existing one if it already exists):</p> <pre><code>GRUB_ENABLE_BLSCFG=false</code></pre> <p>Then generate <code>grub.cfg</code> with:</p> <pre><code>grub2-mkconfig -o /boot/grub2/grub.cfg</code></pre> <div id="footer"> <hr /> <ul> <li><a href="/news/policy.html">Binary Blob Reduction Policy</a></li> <li><a href="/freedom-status.html">Freedom status</a></li> <li><a href="/git.html">Edit this page</a></li> <li><a href="/who.html">Who develops Libreboot?</a></li> <li><a href="/license.html">License</a></li> <li><a href="/template-license.html">Template</a></li> <li><a href="/logo-license.html">Logo</a></li> <li><a href="/contrib.html">Authors</a></li> </ul> <hr /> </div> <p>Markdown file for this page: <a href="https://libreboot.org/docs/linux/index.md" class="uri">https://libreboot.org/docs/linux/index.md</a></p> <p><a href="/feed.xml">Subscribe to RSS for this site</a></p> <p><a href="/sitemap.html">Site map</a></p> <p>This HTML page was generated by the <a href="https://untitled.vimuser.org/">Untitled Static Site Generator</a>.</p> </div> </div> </body> </html>