Grub rescue after bios update

poolitzer · October 29, 2025, 10:36am

Hello,

I did a BIOS update because the software app wanted to push some signature updates for secure boot into it (if I understood that correctly) and found it didn’t have enough space. The BIOS did not allow me to somehow reset the keys as suggested online, so I hoped an update would introduce that option (it was from 2022).

It did not, and it also screwed up the boot order because it booted into windows now. When I swapped that back to opensuse, I got the prompt for my passphrase, as usual, and then the grub rescue shell opened, with no error.

When I now boot into a live rescue cd environment, I can successfully follow Common problems and their solutions | Start-Up | openSUSE Leap 15.6 after unlocking the volume with cryptsetup like here https://askubuntu.com/a/63598. But when I run the mkconfig call it has a lot of WARNING: failed to init udev for external device info, using none. lines and it doesn’t magically fix it sadly.

Can someone help me?

arvidjaar · October 29, 2025, 10:50am

Start with providing the actual information instead of long stories.

Are you using legacy BIOS or EFI?

Post from live environment:

lsblk -f -o +partuuid

as well as

cat /etc/fstab

from your root filesystem.

poolitzer · October 29, 2025, 11:08am

I have EFI

lsblk resulted in

NAME FSTYPE FSVER LABEL                         UUID                                   FSAVAIL FSUSE% MOUNTPOINTS PARTUUID
loop0
     squash 4.0                                                                              0   100% /run/overlay/squashfs_container
                                                                                                                  
loop1
     ext4   1.0                                 02bfe5e0-251d-45f1-b785-9e2fea3050e4    643.9M    72% /run/overlay/rootfsbase
                                                                                                                  
sda                                                                                                               
├─sda1
│                                                                                                                 497cd759-57f5-48a2-b1b5-c5a48d2f04b0
├─sda2
│    vfat   FAT32                               E285-6C1D                                                         8d3e6b4b-e416-466c-bc05-93d7137dbcf8
└─sda3
     ntfs         Extern                        B06632AC66327368                                                  f7d1ce82-120c-4b01-9779-6d3c1b70b551
sdb                                                                                                               
├─sdb1
│                                                                                                                 13a92ce7-aef9-4fdb-a7b1-a8a90fd3579e
└─sdb2
     ntfs         samsung                       42F07346F0733F6B                                                  0782a3ce-be0f-497d-88b4-149b70573404
sdc                                                                                                               
├─sdc1
│    vfat   FAT32                               AF70-8383                                                         e748ff6f-7166-4ac6-8a0b-538e87b511c3
└─sdc2
  │  crypto 2                                   34857fba-c4fd-4477-8b24-a3b9d559508d                              20512cf5-db7c-41c7-9f39-102ac06fcee9
  └─encrypted_volume
    │  LVM2_m LVM2                                iyci8M-2yue-kVPk-QUzy-WXCm-uvDX-d7YGxZ                            
    ├─system-swap
    │  swap   1                                   48ade5ad-2745-4a9f-9ffd-d53ec2d54e2f                              
    ├─system-home
    │  xfs                                        c4406ed5-4ac8-479f-b51d-5b354b5b3326                              
    └─system-root
       btrfs                                      fc775916-207b-422e-b585-819782795d7a    232.1G    24% /run/media/my_device
                                                                                                                    
sdd  iso966 Jolie openSUSE_Tumbleweed_Rescue_CD 2025-09-12-13-31-52-00                                            
├─sdd1
│    iso966 Jolie openSUSE_Tumbleweed_Rescue_CD 2025-09-12-13-31-52-00                       0   100% /run/overlay/live
│                                                                                                                 35323032-3930-4231-b131-303333313532
├─sdd2
│    vfat   FAT16 BOOT                          A88C-5883                                                         35323032-3930-4231-b132-303333313532
└─sdd3
     ext4   1.0   cow                           5be3aab9-95c4-4cb4-b58a-673ffadef8ac     12.6G     1% /run/overlay/overlayfs
                                                                                                                  61c76a12-5264-48b6-bbb1-982d56a30be2
nvme0n1
│                                                                                                                 
├─nvme0n1p1
│                                                                                                                 5648ff67-b9f8-4486-9474-0356963080f5
├─nvme0n1p2
│    ntfs                                       1200823B00822637                                                  9b27d62e-af2b-4a75-959c-d96952c18303
└─nvme0n1p3
     ntfs                                       22448C28448BFCB3                                                  37fa88b6-e6cf-41f3-9a4c-f21c5f7f894f

and fstab

:/ # cat /etc/fstab 
/dev/system/root  /                       btrfs  defaults                      0  0
/dev/system/root  /var                    btrfs  subvol=/@/var                 0  0
/dev/system/root  /usr/local              btrfs  subvol=/@/usr/local           0  0
/dev/system/root  /srv                    btrfs  subvol=/@/srv                 0  0
/dev/system/root  /root                   btrfs  subvol=/@/root                0  0
/dev/system/root  /opt                    btrfs  subvol=/@/opt                 0  0
/dev/system/home  /home                   xfs    defaults                      0  0
/dev/system/root  /boot/grub2/x86_64-efi  btrfs  subvol=/@/boot/grub2/x86_64-efi  0  0
/dev/system/root  /boot/grub2/i386-pc     btrfs  subvol=/@/boot/grub2/i386-pc  0  0
/dev/system/swap  swap                    swap   defaults                      0  0
/dev/system/root  /.snapshots             btrfs  subvol=/@/.snapshots          0  0
UUID=AF70-8383    /boot/efi               vfat   utf8                          0  2
UUID=42F07346F0733F6B /run/media/poolitzer/samsung ntfs uid=1000,gid=1000,rw,user,exec,umask=000 0 0

for that I chrooted into the root volume, I hope thats what you wanted

arvidjaar · October 29, 2025, 11:13am

OK, then

efibootmgr

poolitzer · October 29, 2025, 11:16am

That gives me

linux@localhost:~> sudo efibootmgr 
BootCurrent: 0005
Timeout: 1 seconds
BootOrder: 0005,0004,0002,0003,0000
Boot0000* Windows Boot Manager HD(2,GPT,8d3e6b4b-e416-466c-bc05-93d7137dbcf8,0x8000,0x32000)/File(\EFI\MICROSOFT\BOOT\BOOTMGFW.EFI)57494e444f5753000100000088000000780000004200430044004f0042004a004500430054003d007b00390064006500610038003600320063002d0035006300640064002d0034006500370030002d0061006300630031002d006600330032006200330034003400640034003700390035007d00000061000100000010000000040000007fff0400
Boot0002* debian HD(2,GPT,8d3e6b4b-e416-466c-bc05-93d7137dbcf8,0x8000,0x32000)/File(\EFI\DEBIAN\GRUBX64.EFI)0000424f
Boot0003* ubuntu HD(2,GPT,8d3e6b4b-e416-466c-bc05-93d7137dbcf8,0x8000,0x32000)/File(\EFI\UBUNTU\SHIMX64.EFI)0000424f
Boot0004* opensuse HD(1,GPT,e748ff6f-7166-4ac6-8a0b-538e87b511c3,0x800,0x100000)/File(\EFI\OPENSUSE\GRUBX64.EFI)0000424f
Boot0005* UEFI: KingstonDataTraveler 3.0PMAP, Partition 2 PciRoot(0x0)/Pci(0x8,0x1)/Pci(0x0,0x3)/USB(2,0)/HD(2,GPT,35323032-3930-4231-b132-303333313532,0x15e1c4,0xa000)0000424f

arvidjaar · October 29, 2025, 11:18am

Is Secure Boot active?

mokutil --sb-state

poolitzer · October 29, 2025, 11:19am

it says SecureBoot enabled, so yes, as it was before. Always fun installing nvidia drivers and missing the mok prompt

arvidjaar · October 29, 2025, 11:23am

Your openSUSE boot entry points to the unsigned GRUB2 image, so I am not sure how it could have worked before. Post

grep -Ev '^$|^#' /etc/sysconfig/bootloader

from your root filesystem. Also, try to boot into openSUSE and post photo of the screen where GRUB2 stops.

And you did not provide the output of the command I requested.

poolitzer · October 29, 2025, 11:48am

maybe it got unsigned through my attempts to rebuild it?

:/ # grep -Ev '^$|^#' /etc/sysconfig/bootloader
LOADER_TYPE="grub2-efi"
SECURE_BOOT="yes"
TRUSTED_BOOT="no"
UPDATE_NVRAM="yes"
:/ #

screenshot

And you did not provide the output of the command I requested.

sorry

arvidjaar · October 29, 2025, 11:53am

You apparently misunderstand. If Secure Boot is active, you simply cannot load and start grub at all or you are actually loading some different grub. Apparently, Secure Boot is not active and I simply try to find out the actual state of your system.

Whether you are sorry or not is immaterial. What matters is the output of commands that show the current state.

poolitzer · October 29, 2025, 11:57am

linux@localhost:~> mokutil --sb-state 
SecureBoot enabled

arvidjaar · October 29, 2025, 11:59am

That matches your description that the system loads Windows by default. How exactly you “swapped back to openSUSE”? Do you select it manually or is it loaded automatically?

poolitzer · October 29, 2025, 12:02pm

In the bios settings I set opensuse as the UEFI Hard DIsk Drive BBS Priority Boot option #1.

arvidjaar · October 29, 2025, 12:27pm

Inch by inch …

Yes, as expected you were loading the different grub, not the one in the boot options.

Mount root, run update-bootloader:

mount /dev/system/root /mnt
mount --rbind /sys /mnt/sys
mount --bind /dev /mnt/dev
mount --bind /proc /mnt/proc
mount --bind /run /mnt/run
chroot /mnt
mount -a -t btrfs
mount UUID=AF70-8383 /boot/efi
update-bootloader --reinit

poolitzer · October 29, 2025, 12:46pm

This ran through without an error. I unmounted, closed the encryption, rebooted, but it still boots into grub rescue

arvidjaar · October 29, 2025, 12:49pm

Show

efibootmgr

again.

poolitzer · October 29, 2025, 12:56pm

linux@localhost:~> sudo efibootmgr 
BootCurrent: 0005
Timeout: 1 seconds
BootOrder: 0005,0004,0002,0003,0000,0001
Boot0000* Windows Boot Manager HD(2,GPT,8d3e6b4b-e416-466c-bc05-93d7137dbcf8,0x8000,0x32000)/File(\EFI\MICROSOFT\BOOT\BOOTMGFW.EFI)57494e444f5753000100000088000000780000004200430044004f0042004a004500430054003d007b00390064006500610038003600320063002d0035006300640064002d0034006500370030002d0061006300630031002d006600330032006200330034003400640034003700390035007d00000061000100000010000000040000007fff0400
Boot0001* opensuse-secureboot HD(1,GPT,e748ff6f-7166-4ac6-8a0b-538e87b511c3,0x800,0x100000)/File(\EFI\OPENSUSE\SHIM.EFI)
Boot0002* debian HD(2,GPT,8d3e6b4b-e416-466c-bc05-93d7137dbcf8,0x8000,0x32000)/File(\EFI\DEBIAN\GRUBX64.EFI)0000424f
Boot0003* ubuntu HD(2,GPT,8d3e6b4b-e416-466c-bc05-93d7137dbcf8,0x8000,0x32000)/File(\EFI\UBUNTU\SHIMX64.EFI)0000424f
Boot0004* opensuse HD(1,GPT,e748ff6f-7166-4ac6-8a0b-538e87b511c3,0x800,0x100000)/File(\EFI\OPENSUSE\GRUBX64.EFI)0000424f
Boot0005* UEFI: KingstonDataTraveler 3.0PMAP, Partition 2 PciRoot(0x0)/Pci(0x8,0x1)/Pci(0x0,0x3)/USB(6,0)/HD(2,GPT,35323032-3930-4231-b132-303333313532,0x15e1c4,0xa000)0000424f
linux@localhost:~>

ohh secure-boot is there now

arvidjaar · October 29, 2025, 12:57pm

What happens if you select it in your BIOS boot menu?

poolitzer · October 29, 2025, 12:59pm

wow its back. Thank you a bunch.

system · November 5, 2025, 12:59pm

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.