No Grub to launch my new Debian 10 with LUKS&LVM (UEFI)
DebianThis forum is for the discussion of Debian Linux.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
[ABANDONMENT] No Grub to launch my new Debian 10 with LUKS&LVM (UEFI)
Hi,
I have a recent Lenovo ThinkPad X390 with Windows pre-installed.
Some months ago, I installed Debian 9 Stretch on it and upgraded it some time after to Debian 10 Buster. No particular issue so far, Debian was working as expected in dual-boot with Windows.
But following a power hardware issue, I sent my laptop back to Lenovo for reparation.
They gave it back to me last week but with a cleared SSD (only pre-installed Windows 10 on it).
It was no big deal since I wanted to reinstall my Debian (directly to version 10, not 9) and, above all, I wanted now to encrypt my whole disk with LUKS and LVM (LVM is contained inside the LUKS container, not the contrary, so there is only 1 password).
So I made a bootable Debian 10 USB key and installed a new fresh Debian again in dual-boot.
First I created a new partition on my SSD to leave Windows alone and then I did my best to configure LUKS and LVM via the Debian installer (4 logical volumes for /, /home, /var and swap). I created a 300MB /boot partition outside LUKS to be more compatible with Grub.
Everything went well except I can't boot easily on my fresh-new Debian, I don't even see Grub. Windows is launched automatically.
My only solution is to launch a rEFInd USB key, boot on it and select either "Boot EFI\Boot\grubx64.efi from SYSTEM" or "Boot EFI\debian\grubx64.efi from SYSTEM" (among 6 options, see below) in order to launch my Debian. It's not very handy but it seems to indicate I'm not very far from the solution because everything works fine after that (it proves that my Linux is well installed)...
The following didn't resolve anything even if command outputs were encouraging (those commands have been entered after booting on Debian via rEFInd):
Code:
apt install --reinstall grub-efi
Reading package lists... Done
Building dependency tree
Reading state information... Done
0 upgraded, 0 newly installed, 1 reinstalled, 0 to remove and 0 not upgraded.
Need to get 2560 B of archives.
After this operation, 0 B of additional disk space will be used.
Get:1 http://deb.debian.org/debian buster/main amd64 grub-efi amd64 2.02+dfsg1-20 [2560 B]
Fetched 2560 B in 0s (94.6 kB/s)
(Reading database ... 102187 files and directories currently installed.)
Preparing to unpack .../grub-efi_2.02+dfsg1-20_amd64.deb ...
Unpacking grub-efi (2.02+dfsg1-20) over (2.02+dfsg1-20) ...
Setting up grub-efi (2.02+dfsg1-20) ...
grub-install /dev/nvme0n1
Installing for x86_64-efi platform.
Installation finished. No error reported.
update-grub
Generating grub configuration file ...
Found background image: /usr/share/images/desktop-base/desktop-grub.png
Found linux image: /boot/vmlinuz-4.19.0-6-amd64
Found initrd image: /boot/initrd.img-4.19.0-6-amd64
Found Windows Boot Manager on /dev/nvme0n1p1@/EFI/Microsoft/Boot/bootmgfw.efi
Adding boot menu entry for EFI firmware configuration
done
Some useful details:
Code:
uname -a
Linux ikki 4.19.0-6-amd64 #1 SMP Debian 4.19.67-2+deb10u2 (2019-11-11) x86_64 GNU/Linux
lsblk -o NAME,FSTYPE,LABEL,MOUNTPOINT,SIZE
NAME FSTYPE LABEL MOUNTPOINT SIZE
sda iso9660 rEFInd_0.11.4 29,9G
nvme0n1 477G
├─nvme0n1p1 vfat SYSTEM /boot/efi 260M
├─nvme0n1p2 16M
├─nvme0n1p3 ntfs Windows 122,1G
├─nvme0n1p4 ntfs WinRE_DRV 1000M
├─nvme0n1p5 ext4 /boot 300M
└─nvme0n1p6 crypto_LUKS 353,3G
└─nvme0n1p6_crypt LVM2_member 353,3G
├─myLvmGroup-myLvmSwap swap [SWAP] 14,9G
├─myLvmGroup-myLvmVar ext4 var /var 18,6G
├─myLvmGroup-myLvmRoot ext4 racine / 74,5G
└─myLvmGroup-myLvmHome ext4 home /home 186,3G
fdisk -l
Disk /dev/nvme0n1: 477 GiB, 512110190592 bytes, 1000215216 sectors
Disk model: SAMSUNG MZVLB512HAJQ-000L7
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Device Start End Sectors Size Type
/dev/nvme0n1p1 2048 534527 532480 260M EFI System
/dev/nvme0n1p2 534528 567295 32768 16M Microsoft reserved
/dev/nvme0n1p3 567296 256567295 256000000 122.1G Microsoft basic data
/dev/nvme0n1p4 998166528 1000214527 2048000 1000M Windows recovery environment
/dev/nvme0n1p5 256567296 257181695 614400 300M Linux filesystem
/dev/nvme0n1p6 257181696 998166527 740984832 353.3G Linux filesystem
Quote:
UEFI BIOS version : N2JET83W (1.61) UEFI BIOS Date : 2019-11-22 Embedded Controller Version : N2JHT32W (1.16) ME Firmware Version : 12.0.40.1433 UEFI Secure Boot : Off (just to allow my rEFInd bootable USB key to be launched properly. When my issue will be resolved, I will certainly reactivate UEFI Secure Boot since I've been told that Debian 10 now deals with it appropriately) UEFI Only - No CSM support Default booting on SSD first
rEFInd choices and results:
Quote:
rEFInd (0.11.4):
Boot Microsoft EFI boot from SYSTEM (--> it launches Windows OK)
Boot EFI\Boot\grubx64.efi from SYSTEM (--> it launches Grub 2.02 where I can choose "Debian GNU/Linux" and access my Debian eventually)
Boot EFI\Boot\LenovoBT.EFI from SYSTEM (--> it gives me a fatal error "ASSERT c:\code\efi\source\edk2\ShellPkg\Application\Shell\ShellParametersProtocol.c(368): !EFI_ERROR (Status)")
Boot EFI\debian\grubx64.efi from SYSTEM (--> it launches Grub 2.02 where I can choose "Debian GNU/Linux" and access my Debian eventually)
Boot failback boot loader from SYSTEM (--> it reboots my laptop and launches Windows)
Boot vmlinuz-4.19.0-6-amd64 from boot (--> I get an ash shell BusyBox v1.30.1 with a "(initramfs)" prompt and I don't know what I'm supposed to do...)
I have the feeling I have too many .efi files, don't I have?
Could someone give me some hints in order to have Grub displaying itself after powering on my laptop so I can easily choose to launch Debian or Windows?
Please be explicit as I'm not really used to booting processes, especially in UEFI/GPT mode...
Have you tried to go into the uefi bios setup and make changes there to the boot order? Try pressing the f1, esc, or one of the other f-keys when you first turn it on to get into the bios setup.
if not able to change in bios, as root post the ouput of
Code:
efibootmgr
Last edited by colorpurple21859; 12-22-2019 at 02:10 PM.
The command you used to install Grub from Debian won't work the way it did on a Legacy system where installing to /dev/sda, or in your particular case to:
grub-install /dev/nvme0n1. You should have Debian EFI files on the EFI partition for windows/DEbian on the first partition (nvme0n1p1). Easy enough to mount that and check. Then as suggested above, you need to go into the BIOS firmware setup and change the boot priority to Debian permanently. Some machines will allow you to do this with efibootmgr.
Obvisouly, I have all the needed EFI files for Debian in /boot/efi/EFI/debian. Why don't I see any Debian entry in my UEFI configuration please?
Anyway, I've created it explicitely:
Code:
efibootmgr -c -d /dev/nvme0n1 -p 1 -L debian -l \EFI\debian\grubx64.efi
BootCurrent: 0021
Timeout: 0 seconds
BootOrder: 0001,001C,001D,0000,001E,001F,0020,0021,001B,0023,0024,0022,0012,0011
Boot0000* Windows Boot Manager
Boot0010 ThinkShield secure wipe
Boot0011* LENOVO CLOUD
Boot0012* HTTPS BOOT
Boot0013 Setup
Boot0014 Boot Menu
Boot0015 Diagnostic Splash Screen
Boot0016 Lenovo Diagnostics
Boot0017 Regulatory Information
Boot0018 Startup Interrupt Menu
Boot0019 Rescue and Recovery
Boot001A MEBx Hot Key
Boot001B* USB CD
Boot001C USB FDD
Boot001D* NVMe0
Boot001E* NVMe1
Boot001F* ATA HDD0
Boot0020* ATA HDD1
Boot0021* USB HDD
Boot0022* PXE BOOT
Boot0023 Other CD
Boot0024 Other HDD
Boot0025* IDER BOOT CDROM
Boot0026* IDER BOOT Floppy
Boot0027* ATA HDD
Boot0028* ATAPI CD
Boot0001* debian
It doesn't change anything after reboot. The boot entry has even disappeared...
Will the system boot on a restart/shutdown if this is ran beforehand?
Code:
efibootmgr -n 0001
something to check
run gdisk on your drive similar to this
Code:
gdisk /dev/nvme0n1
Found valid GPT with protective MBR; using GPT.
Command (? for help): v
this will be message if this is part of the problem
Quote:
Warning: The 0xEE protective partition in the MBR is marked as active. This is technically a violation of the GPT specification, and can cause some EFIs to ignore the disk, but it is required to boot from a GPT disk on some BIOS-based computers. You can clear this flag by creating a fresh protective MBR using
the 'n' option on the experts' menu.
efibootmgr
BootNext: 0001
BootCurrent: 0021
Timeout: 0 seconds
BootOrder: 0001,001C,001D,0000,001E,001F,0020,0021,001B,0023,0024,0022,0012,0011
Boot0000* Windows Boot Manager
Boot0001* debian
Boot0010 ThinkShield secure wipe
Boot0011* LENOVO CLOUD
Boot0012* HTTPS BOOT
Boot0013 Setup
Boot0014 Boot Menu
Boot0015 Diagnostic Splash Screen
Boot0016 Lenovo Diagnostics
Boot0017 Regulatory Information
Boot0018 Startup Interrupt Menu
Boot0019 Rescue and Recovery
Boot001A MEBx Hot Key
Boot001B* USB CD
Boot001C USB FDD
Boot001D* NVMe0
Boot001E* NVMe1
Boot001F* ATA HDD0
Boot0020* ATA HDD1
Boot0021* USB HDD
Boot0022* PXE BOOT
Boot0023 Other CD
Boot0024 Other HDD
Boot0025* IDER BOOT CDROM
Boot0026* IDER BOOT Floppy
Boot0027* ATA HDD
Boot0028* ATAPI CD
and don't allow me to boot on debian (0001) as advertised.
Actually, it seems that efibootmgr -n 0001 is already called after the debian entry creation so it's superfluous here...
Quote:
Originally Posted by colorpurple21859
something to check
run gdisk on your drive similar to this
Code:
gdisk /dev/nvme0n1
Found valid GPT with protective MBR; using GPT.
Command (? for help): v
this will be message if this is part of the problem
Indeed!
Code:
gdisk /dev/nvme0n1
GPT fdisk (gdisk) version 1.0.3
Partition table scan:
MBR: protective
BSD: not present
APM: not present
GPT: present
Found valid GPT with protective MBR; using GPT.
What am I supposed to do? If I just quit ("q"), I get the samed output next time I launch gdisk. If I type "w", gdisk tells me:
Code:
Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING
PARTITIONS!!
I'm not sure I want to overwrite all my existing partitions^^. Maybe this is just a superfluous/generic message here?
By the way, everything is good with option "v":
Code:
No problems found. 2669 free sectors (1.3 MiB) available in 2
segments, the largest of which is 2014 (1007.0 KiB) in size.
EDIT: I've run options "n" and then "w" to create a fresh protective MBR as you wrote it (I don't understand because I thought this protective MBR was the problem):
Code:
Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING
PARTITIONS!!
Do you want to proceed? (Y/N): Y
OK; writing new GUID partition table (GPT) to /dev/nvme0n1.
Warning: The kernel is still using the old partition table.
The new table will be used at the next reboot or after you
run partprobe(8) or kpartx(8)
The operation has completed successfully.
I've run option "w" as well just after the message "Found valid GPT with protective MBR; using GPT.". The output is the same but let's wait &see after a reboot now...
Ok, I've rebooted.
Nothing has changed, I still have the same global issue
It's weird because gdisk still tells me "Found valid GPT with protective MBR; using GPT.".
Obviously, option "n" did not delete this protective MBR...
Am I supposed to do the following?
Warning: The 0xEE protective partition in the MBR is marked as active. This is technically a violation of the GPT specification, and can cause some EFIs to ignore the disk, but it is required to boot from a GPT disk on some BIOS-based computers. You can clear this flag by creating a fresh protective MBR using
the 'n' option on the experts' menu.
and now getting this message
Quote:
No problems found. 2669 free sectors (1.3 MiB) available in 2
segments, the largest of which is 2014 (1007.0 KiB) in size.
Warning: The 0xEE protective partition in the MBR is marked as active. This is technically a violation of the GPT specification, and can cause some EFIs to ignore the disk, but it is required to boot from a GPT disk on some BIOS-based computers. You can clear this flag by creating a fresh protective MBR using
the 'n' option on the experts' menu.
I just have:
Quote:
Partition table scan:
MBR: protective
BSD: not present
APM: not present
GPT: present
Found valid GPT with protective MBR; using GPT.
Unfortunately, the following does nothing better after manipulations via gdisk:
The boot order I'm talking about changing is in the bios setup where secure boot is turned on/off, legacy boot enable/disabled, ect
Oh! I thought you were speaking about efibootmgr.
Ok, but I don't know what modification should be better in my current configuration as I don't see any Linux/Debian entry...
I've eventually given up as I didn't know what else to try...
Instead I've taken advantage of the opportunity to delete Windows install from my new laptop (except its recovery and small reserved partitions).
It has resolved some of my problems but I have another one: Debian 10 cannot launch with Secure Boot activated (I've created a new thread on this same Debian subforum).
For those interested, here is a new information.
I cannot be sure it was the root cause, but it didn't help for sure.
I've realized that I had "enabled" options "Lock UEFI BIOS Settings" along with "Boot Order Lock" in ThinkPad Setup at startup. That's the reason why changes via efibootmgr didn't survive after reboot.
Maybe my new Debian boot loader would have done the job without those options but I cannot confirm now that I've erased my whole Windows installation
HIH
[QUOTE]I've realized that I had "enabled" options "Lock UEFI BIOS Settings" along with "Boot order lock" in ThinkPad Setup at startup./QUOTE] I agree that is most likely the cause of your problems. Not every system has those firmware options.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
[ABANDONMENT] No Grub to launch my new Debian 10 with LUKS&LVM (UEFI)
