Month: January 2025

Secure Boot Shim-anigans Ahoy!

Posted on by dk

So, I had to purchase a new laptop for someone, and as per usual, it came with the entire SSD capacity allocated, which I still feel is bad practice – specifically ensuring there is unallocated space that the drive firmware knows about, assuming TRIM is supported by both OS, controller and drive, (which, AFAIK, all “modern” OS and hardware do) to improve the drive’s wear-leveling ability and thereby extending the SSD’s lifespan.

To do so, I use a “rule of thumb” to leave ~20% of unpartitioned space – at the “end” of the disk (from a “logical” view of the partition table, regardless MBR or GPT). Usually, I simply use a “multi-boot” USB stick created using YUMI or Ventoy (the former now looking like a “wrapping” of the latter in its latest “exFAT” variant).

Aware of the shenanigans/rain dance required to make UEFI secure boot work from such bootloaders, like hundreds of other times (but never done for awhile), I simply (1) disabled CSM in BIOS, (2) enabled secure boot (and rebooted), (3) manually loaded the ENROLL_THIS_KEY_IN_MOKMANAGER.cer into the key store via BIOS from the prepared Ventoy USB disk…

I then confidently rebooted the laptop, pointing to the USB UEFI as the boot device, then ran headlong into the wall with a sickening SMACK. The wall was black, with only the words “Verifying shim SBAT data failed: Security Policy Violation” emblazoned across the top…

Attempting to fix this on this “new” laptop took me off on tangent, wasting nearly a half day trying to research and resolve… Hopefully this helps someone else with the “summary” below, assuming you have a working Linux system that can mount the USB device’s bootloader (i.e. EFI partition), since Windows cannot (without jumping through hoops)…

Continue reading →

Adventures with a Qotom C3758R Unit

Posted on by dk

I purchased a Qotom Intel Atom (“Denverton”) C3758R* w/4x SFP+ port “mini server”, with the intention to utilise the SFP+ ports and upgrade my home Internet connection to 10Gbps…

Here are some of the main (pain?) points:

  • I had to obtain the manual from the seller/supplier; I’m plugging it here for convenience…
  • WARNING: VGA-only!
    • I bought the device, more worried about the number of ETH and SFP+ ports than “trivialities” like the display output (expecting anything post-2020 to have HDMI or DP output), so was totally caught off guard when it arrived with only VGA output, with nary a VGA-capable display in sight…
    • I dragged the device to an older Dell 2719H display that was nearby, and “borrowed” a VGA cable from my cousin, then proceeded to start testing…
    • thankfully, a “rushed order” Vention VGA-to-HDMI* adapter came to the rescue soon after – beware that although it supported the BIOS mode, certain other low-resolution text modes are not (looking nastily at gparted‘s keyboard mapping/initialisation screen); I cannot say if the installation of the Ubuntu 24.04 LTS image from my Ventoy multiboot USB stick would work through the VGA adapter, as I did the installation using the Dell 2719H display…
    • as a back up, you could attempt to configure and install everything through the console…
  • AMI BIOS with Test MOKs (Machine Owner Key)!
  • Slow start-up w/A-Tech 2x 32GB DDR4 3200MHz ECC Unbuffered SODIMMs* (yes, I may confirm they work, but as of writing this, there is a cheaper NEMIX alternative* – from Amazon Singapore anyway)
    • due to RAM tests, you get a blank screen all the way till after BIOS and VGA output is initiated (and not because of the aforementioned VGA-to-HDMI adapter being unable to convert either – this happened with the VGA-capable Dell 2719H also)
    • I had to set the BIOS options to do start-up memory tests in parallel (which sped things up a bit) (picture from the console redirection through PuTTY):
  • the on-board USB3 controller does not play nice with my IOGear 4-port GUS434 USB3.0 switch* (which I believe is a white-label of the Aten US434*) although it worked just fine on Windows and Mac OSX:

    • repeated attempts to play around in the BIOS’ USB settings ultimately resulted in an accidental USB port disablement – i.e. keyboard lock-out, which meant having to open the thing up to pull the battery, waiting a minute, then plugging everything back in and setting up the BIOS options again (because I hadn’t gotten my USB-to-serial cable and OS console redirection working yet)…
    • TBH, I believe this is a Linux kernel bug, but after many wasted hours, I still haven’t figured out how to fix this…

 

  • dmesg warnings:
    • workqueue: drm_fb_helper_damage_work hogged CPU for >10000us 256 times, consider switching to WQ_UNBOUND
    • ismt_smbus 0000:00:12.0: completion wait timed out
  • Intel X553 port #4 (eno4) doesn’t seem to be working properly (ethtool -m fails), although links can be brought up:

 

  • booting and controlling the unit through the serial console redirection:
    • another rushed order for a USB to RJ45 serial/console cable* enabled me to utilize the “standard” console port of the C3758R (for the arguable use of the word “standard”):
      • from the Qotom C3758R user manual, with my own annotations denoting pin number:
      • screenshot from Cisco’s ASA 5585-X Cable PDF with the “important” bits highlighted:
    • thankfully, by default, the BIOS is set to automatically redirects to the console with the following parameters:

      • you may just wish to change the “ANSI” setting to “VT100+” (like I did before taking this screenshot – the “ANSI” value selected is just for depicting actual values) just to “clean up” the UI, as PuTTY doesn’t seem to handle the ANSI character formatting all that well…
    • searching dmesg post-Ubuntu-install showed ttyS4 as the serial port device

 

So far, so good, I will provide more updates as I go through the process of OS + QEMU+KVM installation, testing of the SFP+ direct-attached optical connectors and RJ45 10GbE modules.

 

*NOTE: This is an affiliate link, so I may get some commission, but at no additional cost to purchasers purchasing through this link. For Amazon Affiliate links, as an Amazon Associate, I earn from qualifying purchases.