gfl94
commented
6 months ago similar case seeing from my side..
found a lot of reference:
https://github.com/lcp/mokutil/issues/11 https://www.reddit.com/r/linux4noobs/comments/ow771j/how_do_you_get_mokmanager_to_come_up_during_the/ https://www.reddit.com/r/AZURE/comments/undlna/mokmanager_and_serial_console/
confirmed my Azure VM has efibootmgr entry configured correctly, booting from shimx64.efi instead of grubx64.efi:
root@xxx:/boot/efi/EFI# efibootmgr -v
BootCurrent: 0001
Timeout: 0 seconds
BootOrder: 0002,0001
Boot0000* MsTemp AcpiEx(VMBus,,)/VenHw(9b17e5a2-0891-42dd-b653-80b5c22809ba,d96361baa104294db60572e2ffb1dc7f1a78b3f8821e1848a1c363d806ec15bb)/SCSI(0,0)/HD(15,GPT,2627d760-797e-45fc-b3bc-965cb41cd122,0x2800,0x35000)
Boot0001* ubuntu HD(15,GPT,2627d760-797e-45fc-b3bc-965cb41cd122,0x2800,0x35000)/File(\EFI\ubuntu\shimx64.efi)
Boot0002* ubuntu_custom HD(1,GPT,e20b901a-844f-4e5f-84e1-12f887ba3071,0x37800,0x3bc8fdf)/File(\EFI\ubuntu\shimx64.efi)it is still unable to work, not able to see any MokManager entry while rebooting in serial console.
Anyone gets any idea to resolve this?
We are attempting to load 3rd party drivers with SecureBoot on a RHEL 8 VM on Azure. I know this is probably not a bug with mokutil, but mokmanager never appears at boot, and the new keys are cleared. This process works just fine for us on physical servers and VMWare. But, with Azure, the serial console appears to not engage until it is too late, or otherwise interrupt the shim boot.
I have confirmed via efibootvars that a shim boot is the default. RedHat sent me some commands to extend the timeout for the boot process, but this only caused a hang for about 2 minutes after the console shows "reboot: Restarting system."
echo -en "\xff\xff" > /tmp/2bytes efivar -f /tmp/2bytes -A 7 -w -n 605dab50-e046-4300-abb6-3dd810dd8b23-MokTimeout mokutil --import vendorcrt.der reboot
Just wondering if there are any possible workarounds for this issue. I am relatively certain it has to do with Azure's console.