Getting Plymouth working with GRUB & LUKS-encrypted EXT4 partition

[Feakster]

Problem

Could someone lend me a hand? I can’t seem to get the Plymouth decryption screen to show.

Packages

I’ve installed the plymouth package from the AUR.

Config File Sections

/etc/default/grub kernel params:

GRUB_CMDLINE_LINUX_DEFAULT="loglevel=3 udev.log_level=3 vt.global_cursor_default=0 nowatchdog quiet splash mitigations=off"
GRUB_CMDLINE_LINUX="cryptdevice=UUID=6d38f759-8c9a-4ad3-aa7a-89300f47a7a5:luks-6d38f759-8c9a-4ad3-aa7a-89300f47a7a5:allow-discards root=/dev/mapper/luks-6d38f759-8c9a-4ad3-aa7a-89300f47a7a5"
GRUB_ENABLE_CRYPTODISK=y

/etc/mkinitcpio.conf HOOKS & MODULES:

MODULES="i915 amdgpu"
HOOKS="base udev plymouth autodetect modconf block keyboard keymap plymouth-encrypt filesystems fsck"

systemctl Stuff

I’ve disabled sddm.service & enabled sddm-plymouth.service.

GRUB & Ramdisk

I’ve also run:

sudo mkinitcpio -P
sudo grub-mkconfig -o /boot/grub/grub.cfg

System Info

sudo inxi --admin --verbosity=7 --filter --no-host --width

System:
  Kernel: 5.13.9-zen1-1-zen x86_64 bits: 64 compiler: gcc v: 11.1.0 
  parameters: BOOT_IMAGE=/boot/vmlinuz-linux-zen 
  root=UUID=2fab759e-ecae-4e84-a991-4b024381cc6e rw 
  cryptdevice=UUID=6d38f759-8c9a-4ad3-aa7a-89300f47a7a5:luks-6d38f759-8c9a-4ad3-aa7a-89300f47a7a5:allow-discards 
  root=/dev/mapper/luks-6d38f759-8c9a-4ad3-aa7a-89300f47a7a5 loglevel=3 
  udev.log_level=3 vt.global_cursor_default=0 nowatchdog quiet splash 
  mitigations=off 
  Console: tty pts/1 wm: kwin_x11 DM: SDDM Distro: EndeavourOS 
  base: Arch Linux 
Machine:
  Type: Desktop System: Intel Client Systems product: NUC8i7HVK v: J71485-504 
  serial: <filter> Chassis: Intel Corporation type: 3 v: 2.0 serial: N/A 
  Mobo: Intel model: NUC8i7HVB v: J68196-504 serial: <filter> UEFI: Intel 
  v: HNKBLi70.86A.0066.2021.0310.1823 date: 03/10/2021 
Battery:
  Device-1: hidpp_battery_0 model: Logitech MX Keys Wireless Keyboard 
  serial: <filter> charge: 50% (should be ignored) rechargeable: yes 
  status: Charging 
Memory:
  RAM: total: 31.27 GiB used: 2.16 GiB (6.9%) 
  Array-1: capacity: 32 GiB slots: 2 EC: None max-module-size: 16 GiB 
  note: est. 
  Device-1: ChannelA-DIMM0 size: 16 GiB speed: 3200 MT/s type: DDR4 
  detail: synchronous unbuffered (unregistered) bus-width: 64 bits 
  total: 64 bits manufacturer: Micron part-no: 16ATF2G64HZ-3G2E1 
  serial: <filter> 
  Device-2: ChannelB-DIMM0 size: 16 GiB speed: 3200 MT/s type: DDR4 
  detail: synchronous unbuffered (unregistered) bus-width: 64 bits 
  total: 64 bits manufacturer: Micron part-no: 16ATF2G64HZ-3G2E1 
  serial: <filter>
CPU:
  Info: Quad Core model: Intel Core i7-8809G bits: 64 type: MT MCP 
  arch: Kaby Lake family: 6 model-id: 9E (158) stepping: 9 microcode: EA 
  cache: L2: 8 MiB bogomips: 49599 
  Speed: 800 MHz min/max: 800/8300 MHz Core speeds (MHz): 1: 800 2: 888 3: 900 
  4: 900 5: 900 6: 900 7: 900 8: 835 
  Flags: 3dnowprefetch abm acpi adx aes aperfmperf apic arat arch_perfmon art 
  avx avx2 bmi1 bmi2 bts clflush clflushopt cmov constant_tsc cpuid 
  cpuid_fault cx16 cx8 de ds_cpl dtes64 dtherm dts epb ept ept_ad erms est 
  f16c flexpriority flush_l1d fma fpu fsgsbase fxsr ht hwp hwp_act_window 
  hwp_epp hwp_notify ibpb ibrs ida intel_pt invpcid invpcid_single lahf_lm lm 
  mca mce md_clear mmx monitor movbe mpx msr mtrr nonstop_tsc nopl nx pae pat 
  pbe pcid pclmulqdq pdcm pdpe1gb pebs pge pln pni popcnt pse pse36 pts rdrand 
  rdseed rdtscp rep_good sdbg sep smap smep ss ssbd sse sse2 sse4_1 sse4_2 
  ssse3 stibp syscall tm tm2 tpr_shadow tsc tsc_adjust tsc_deadline_timer vme 
  vmx vnmi vpid x2apic xgetbv1 xsave xsavec xsaveopt xsaves xtopology xtpr 
  Vulnerabilities: Type: itlb_multihit status: KVM: VMX disabled 
  Type: l1tf mitigation: PTE Inversion; VMX: vulnerable 
  Type: mds status: Vulnerable; SMT vulnerable 
  Type: meltdown status: Vulnerable 
  Type: spec_store_bypass status: Vulnerable 
  Type: spectre_v1 status: Vulnerable: __user pointer sanitization and 
  usercopy barriers only; no swapgs barriers 
  Type: spectre_v2 status: Vulnerable, IBPB: disabled, STIBP: disabled 
  Type: srbds status: Vulnerable 
  Type: tsx_async_abort status: Not affected 
Graphics:
  Device-1: Intel HD Graphics 630 driver: i915 v: kernel bus-ID: 00:02.0 
  chip-ID: 8086:591b class-ID: 0380 
  Device-2: AMD Polaris 22 XT [Radeon RX Vega M GH] vendor: Intel 
  driver: amdgpu v: kernel bus-ID: 01:00.0 chip-ID: 1002:694c class-ID: 0300 
  Device-3: Logitech StreamCam type: USB 
  driver: hid-generic,snd-usb-audio,usbhid,uvcvideo bus-ID: 6-1:2 
  chip-ID: 046d:0893 class-ID: 0300 serial: <filter> 
  Display: server: X.Org 1.20.13 compositor: kwin_x11 driver: 
  loaded: amdgpu,ati,intel unloaded: fbdev,modesetting,vesa display-ID: :0 
  screens: 1 
  Screen-1: 0 s-res: 3840x1080 s-dpi: 96 s-size: 1016x285mm (40.0x11.2") 
  s-diag: 1055mm (41.5") 
  Monitor-1: DisplayPort-2 res: 1920x1080 hz: 60 dpi: 93 
  size: 527x296mm (20.7x11.7") diag: 604mm (23.8") 
  Monitor-2: DisplayPort-3 res: 1920x1080 hz: 60 dpi: 93 
  size: 527x296mm (20.7x11.7") diag: 604mm (23.8") 
  OpenGL: renderer: AMD VEGAM (DRM 3.41.0 5.13.9-zen1-1-zen LLVM 12.0.1) 
  v: 4.6 Mesa 21.1.6 direct render: Yes 
Audio:
  Device-1: Intel CM238 HD Audio driver: snd_hda_intel v: kernel 
  bus-ID: 00:1f.3 chip-ID: 8086:a171 class-ID: 0403 
  Device-2: AMD Polaris 22 HDMI Audio vendor: Intel driver: snd_hda_intel 
  v: kernel bus-ID: 01:00.1 chip-ID: 1002:ab08 class-ID: 0403 
  Device-3: Logitech StreamCam type: USB 
  driver: hid-generic,snd-usb-audio,usbhid,uvcvideo bus-ID: 6-1:2 
  chip-ID: 046d:0893 class-ID: 0300 serial: <filter> 
  Sound Server-1: ALSA v: k5.13.9-zen1-1-zen running: yes 
  Sound Server-2: JACK v: 1.9.19 running: no 
  Sound Server-3: PulseAudio v: 15.0 running: no 
  Sound Server-4: PipeWire v: 0.3.33 running: yes 
Network:
  Device-1: Intel Ethernet I219-LM driver: e1000e v: kernel port: f040 
  bus-ID: 00:1f.6 chip-ID: 8086:15b7 class-ID: 0200 
  IF: eno1 state: up speed: 100 Mbps duplex: full mac: <filter> 
  IP v4: <filter> type: dynamic noprefixroute scope: global 
  broadcast: <filter> 
  IP v6: <filter> type: noprefixroute scope: link 
  Device-2: Intel I210 Gigabit Network driver: igb v: kernel port: b000 
  bus-ID: 05:00.0 chip-ID: 8086:157b class-ID: 0200 
  IF: enp5s0 state: down mac: <filter> 
  Device-3: Intel Wireless 8265 / 8275 driver: iwlwifi v: kernel port: b000 
  bus-ID: 06:00.0 chip-ID: 8086:24fd class-ID: 0280 
  IF: wlan0 state: down mac: <filter> 
  WAN IP: <filter> 
Bluetooth:
  Device-1: Intel Bluetooth wireless interface type: USB driver: btusb v: 0.8 
  bus-ID: 1-9:3 chip-ID: 8087:0a2b class-ID: e001 
  Report: rfkill ID: hci0 rfk-id: 1 state: up address: see --recommends 
Logical:
  Message: No logical block device data found. 
RAID:
  Message: No RAID data found. 
Drives:
  Local Storage: total: 1.86 TiB used: 67.31 GiB (3.5%) 
  ID-1: /dev/nvme0n1 maj-min: 259:2 vendor: Samsung model: SSD 970 PRO 1TB 
  size: 953.87 GiB block-size: physical: 512 B logical: 512 B speed: 31.6 Gb/s 
  lanes: 4 rotation: SSD serial: <filter> rev: 1B2QEXP7 temp: 53 Celsius C 
  scheme: GPT 
  SMART: yes health: PASSED on: 196d 8h cycles: 932 
  read-units: 16,852,135 [8.62 TB] written-units: 25,153,224 [12.8 TB] 
  ID-2: /dev/nvme1n1 maj-min: 259:0 vendor: A-Data model: SX8200PNP 
  size: 953.87 GiB block-size: physical: 512 B logical: 512 B speed: 31.6 Gb/s 
  lanes: 4 rotation: SSD serial: <filter> rev: SS0411B temp: 43 Celsius C 
  scheme: GPT 
  SMART: yes health: PASSED on: 1y 134d 17h cycles: 12 
  read-units: 6,251,794 [3.20 TB] written-units: 2,073,336 [1.06 TB] 
  Message: No optical or floppy data found. 
Partition:
  ID-1: / raw-size: 953.36 GiB size: 937.32 GiB (98.32%) 
  used: 67.31 GiB (7.2%) fs: ext4 block-size: 4096 B dev: /dev/dm-0 
  maj-min: 254:0 mapped: luks-6d38f759-8c9a-4ad3-aa7a-89300f47a7a5 label: N/A 
  uuid: 2fab759e-ecae-4e84-a991-4b024381cc6e 
  ID-2: /boot/efi raw-size: 512 MiB size: 511 MiB (99.80%) 
  used: 448 KiB (0.1%) fs: vfat block-size: 512 B dev: /dev/nvme0n1p1 
  maj-min: 259:3 label: NO_LABEL uuid: 5357-2CB5 
Swap:
  Kernel: swappiness: 60 (default) cache-pressure: 100 (default) 
  ID-1: swap-1 type: file size: 512 MiB used: 12.2 MiB (2.4%) priority: -2 
  file: /swapfile 
Unmounted:
  ID-1: /dev/nvme0n1p2 maj-min: 259:4 size: 953.36 GiB fs: N/A label: N/A 
  uuid: 6d38f759-8c9a-4ad3-aa7a-89300f47a7a5 
  ID-2: /dev/nvme1n1p1 maj-min: 259:1 size: 953.87 GiB fs: ext4 label: data 
  uuid: 6972938f-a9bb-4fe2-ae95-516b0026a3f5 
USB:
  Hub-1: 1-0:1 info: Full speed (or root) Hub ports: 16 rev: 2.0 
  speed: 480 Mb/s chip-ID: 1d6b:0002 class-ID: 0900 
  Device-1: 1-3:2 info: Dell Dell Laser Mouse MS3220 type: Mouse,HID 
  driver: hid-generic,usbhid interfaces: 3 rev: 2.0 speed: 12 Mb/s 
  power: 100mA chip-ID: 413c:250e class-ID: 0300 
  Device-2: 1-9:3 info: Intel Bluetooth wireless interface type: Bluetooth 
  driver: btusb interfaces: 2 rev: 2.0 speed: 12 Mb/s power: 100mA 
  chip-ID: 8087:0a2b class-ID: e001 
  Device-3: 1-10:4 info: Logitech Unifying Receiver type: Keyboard,Mouse,HID 
  driver: logitech-djreceiver,usbhid interfaces: 3 rev: 2.0 speed: 12 Mb/s 
  power: 98mA chip-ID: 046d:c52b class-ID: 0300 
  Hub-2: 2-0:1 info: Full speed (or root) Hub ports: 8 rev: 3.0 speed: 5 Gb/s 
  chip-ID: 1d6b:0003 class-ID: 0900 
  Hub-3: 3-0:1 info: Full speed (or root) Hub ports: 2 rev: 2.0 
  speed: 480 Mb/s chip-ID: 1d6b:0002 class-ID: 0900 
  Hub-4: 4-0:1 info: Full speed (or root) Hub ports: 2 rev: 3.1 speed: 10 Gb/s 
  chip-ID: 1d6b:0003 class-ID: 0900 
  Hub-5: 5-0:1 info: Full speed (or root) Hub ports: 2 rev: 2.0 
  speed: 480 Mb/s chip-ID: 1d6b:0002 class-ID: 0900 
  Hub-6: 6-0:1 info: Full speed (or root) Hub ports: 2 rev: 3.1 speed: 10 Gb/s 
  chip-ID: 1d6b:0003 class-ID: 0900 
  Device-1: 6-1:2 info: Logitech StreamCam type: Video,Audio,HID 
  driver: hid-generic,snd-usb-audio,usbhid,uvcvideo interfaces: 6 rev: 3.2 
  speed: 5 Gb/s power: 896mA chip-ID: 046d:0893 class-ID: 0300 
  serial: <filter> 
Sensors:
  System Temperatures: cpu: 66.0 C mobo: 29.8 C gpu: amdgpu temp: 53.0 C 
  Fan Speeds (RPM): N/A 
Info:
  Processes: 255 Uptime: 1h 55m wakeups: 18 Init: systemd v: 249 
  tool: systemctl Compilers: gcc: 11.1.0 Packages: pacman: 1106 lib: 294 
  Shell: Zsh (sudo) v: 5.8 default: Bash v: 5.1.8 running-in: konsole 
  inxi: 3.3.05

What am I missing?

[M1_ke]

@Feakster

/etc/default/grub

Here is my kernel parameters I have a similar setup with BTRFS On Luks with plymouth running and kde installed
GRUB_CMDLINE_LINUX_DEFAULT=“quiet i915.enable_psr=0 cryptdevice=UUID=20219cf1-e980-470b-8d19-be6ae678bb2c:luks-20219cf1->
GRUB_CMDLINE_LINUX=”"

[Feakster]

@M1_ke

GRUB_CMDLINE_LINUX_DEFAULT=“quiet i915.enable_psr=0 cryptdevice=UUID=20219cf1-e980-470b-8d19-be6ae678bb2c:luks-20219cf1->

Is the splash kernel parameter not required?

[M1_ke]

@Feakster

/etc/mkinitcpio.conf

MODULES=“i915 crc32c-intel”
HOOKS=“base udev plymouth plymouth-encrypt autodetect modconf block keyboard keymap encrypt filesystems resume”

Here is my hooks line configuration hope it can be of help as you can change some of the arguments to fit the ext4 configuration that you use

[M1_ke]

Mine does not have the splash but it works well

[M1_ke]

Plymouth with disk encryption not showing splash at startup

Hey, I recently started over with a fresh EOS install to try out something new. I managed to have my root partition which runs on btrfs encrypted with LUKS, and I’m using Gnome DE and GDM. I tried to set up plymouth, and what I read about it made me think that it should be able to also display a nicer looking prompt for the decryption passphrase, instead of just having to entering it into a plane console. My mkinitcpio.conf: HOOKS="base udev plymouth plymouth-encrypt autodetect modconf block …

I followed this post and made some adjustments to fit my usecase maybe it can also be of assistance to you

[Feakster]

@M1_ke

HOOKS=“base udev plymouth plymouth-encrypt autodetect modconf block keyboard keymap encrypt filesystems resume”

Will try this with a slight modification. The Plymouth Arch Wiki says that you’re supposed to replace encrypt with plymouth-encrypt.

[M1_ke]

I applied it to mine right after the plymouth hook i inserted the plymouth-encrypt, but there is an old topic that I used to set up my plymouth that i have linked above maybe it can offer a better insight and help

[Feakster]

I tried variations on your settings above. Sadly, no dice.

[M1_ke]

Did you go to that forum that I linked and check the enlisted methods out

[Feakster]

Yup. Nada. Just gonna ditch all the Plymouth stuff for now.

[M1_ke]

That worked for me on btrfs on luks

[Feakster]

This may explain my lack of joy:

Encrypting an install and GUI for

You are better off re-installing. EOS encrpyts your kernel and initramfs. This means that grub has to unlock the volume before loading your kernel. Unfortunately, grub does not provide a lot of options at that point When distros, like pop, are showing you are a “pretty” unlock screen, they are using plymouth or something similar to do that. However, that requires that your kernel and initram be kept in an unencrypted location. If you are OK with that, during the install create an unencry…

[dalto]

Yes, if your kernel/initrams are encrypted, the decryption is being done by grub before plymouth is loaded.

Of course, you can change that pretty easily if you want to.

[Feakster]

I think I’m going to leave it as is. I might reconsider it if plymouth ever makes it in to the official repos.