Grub resets EFI entries order at every startup

English Install/Boot/Login
1

Hello to everyone,

I’m new to the OpenSuse community, I was a Fedora user before.

My laptop now is running with a dualboot Windows/Tumblebeed, I want to set for first entry Windows and I know how doing that through bios/EFI menu or efibootmanager.

My problems arise when I launch grub or I change some option to grub after I set mine bootorder, it overwrites the order everytime and sets Opensuse to the first entry. I made a workaround for that with two systemd services, one at startup and one before shutdown/halt/poweroff/restart , wich contain the command

efibootmgr -o xxxx,xxxx,etc.

but I would like to find the “problem” in grub config, I never had a similar issue in years of Linux and I can’t find a solution.

Can you help me please?

Bye,
Edo

2

Go into Yast Bootloader.

There should be a box: Update NVRAM Entry

Uncheck that box. After that change, the order should remain stable.

3

Thanks you for reply, I’ve already tried that option and nothing changed.

Other info:
My installation has a separated /boot partition because I wanted encryption only on / and disabled snapshots.

4

It works for me.

I’m using a separate “/boot” and I use encryption.

The problem you were having, is because for some updates Tumbleweed reinstalls the boot loader. Making changes in Yast bootloader may also reinstall the bootloader. Disabling the NVRAM update tells the system that when reinstalling the bootloader, it should not write an entry to NVRAM. It still updates the boot file.

I currently have Windows set as the default for EFI booting. I ran Tumbleweed update earlier today – two weeks after the previous update. And that did reinstall the bootloader. But it left Windows as the default because it did not update NVRAM.

5

It’s strange, I’ll stay with that workaround because the issue is persistent at every OpenSuse startup also without updates. I’ll check this tread, if someone has some idead about this, thanks! :wink:

If can help my laptop is a Huawei Matebook 16.

6

I also have a Lenovo Think Server, which rearranges the boot entries every time. It seems to be a BIOS feature (or misfeature). I can actually change it in the BIOS settings, though occasionally that breaks. Maybe you have a similar BIOS problem.

7

What does it mean? How exactly do you “launch grub”?

8

I’m sorry, I mean when in the bios menu at startup (F12) I choose the efi entry of my grub/opensuse.

Before that I changed my instaliation splitting /boot and / , I tried an installation with full encryption and grub at every startup where asking me for a reset of settings, I don’t know why but maybe is a hint for something.

What I know is that with Fedora and the same laptot I hadn’t this issue.

9

grub does not even support writing EFI variable at boot time. So if anything changes boot entries, it must be either BIOS itself or some operating system service.

grub at every startup where asking me for a reset of settings, I don’t know why but maybe is a hint for something.

No, this is the first time I hear something like this. When exactly this happened? When you were in grub menu? After you selected menu entry to load?

What I know is that with Fedora and the same laptot I hadn’t this issue.

Were there any BIOS update in the meantime?

10

Before entering grub menu, on the top there was written “reset…” and in the middle of the screen a message “press a key to stop the reset” after the press appeared tre options:

  • Reset
  • Not Reset
  • Not ask more

I can’t remember good, but was similar to this and all was with a green background, so something to do with OpenSuse.

(I don’t know how to do multiquote) I think that I hadn’t an update of grub on Fedora in last month, and if is that the problem why OpenSuse at avery startup grub or other system service update even if i disabled update NVARM and os-prober?

11

You may enter UEFI > Boot Menu and move Windows to the top. Save settings and quit. I tried this on a Lenovo ThinkBook and it worked: https://forums.opensuse.org/showthread.php/574148-Lenovo-Thinkbook-Windows-11-Tumbleweed-dual-boot?p=3153077#post3153077 Make sure update nvram is disabled:

erlangen:~ # grep -i nvram /etc/sysconfig/bootloader 
# Update nvram boot settings (UEFI, OF)
UPDATE_NVRAM="no"
erlangen:~ #
12

This is your BIOS, not grub or anything else. Why exactly your BIOS does it we cannot say. Maybe it does not like something in openSUSE grub, who knows. On my Dell Latitude E5450 after some BIOS update, I am prompted on every reboot to press F1 to continue or enter BIOS setup to fix some unidentified problems. It never says what it does not like and what needs fixing.

Hmm … I think in my case these prompts started with some kernel version, so it is possible that newer kernels do something that BIOS does not like (for quite some time I could not even update NVRAM using efibootmgr unless I did it immediately after reboot; leaving system running for several days simply resulted in error trying to set boot variables). If my assumption about kernel interaction holds some water, it could explain the difference with Fedora (different kernel version).

I could only suggest bug report (https://bugzilla.opensuse.org, same user/password as here); may be some grub or kernel developer will have some idea.

Are you using Secure Boot? You may try to change it in BIOS Setup just to check whether it affects this behavior.

Wait, one choice you get is “Not ask more”. Did you try to select it?

13

Update_NVRAM disabled still doesn’t solve.
If I reorder boot from BIOS menu all works for the first startup, after that all entries are reodered automatically.

Yes , Secure Boot is on and I saw an other thing: the first startup after the self-boot reorder is with grubx64.efi and not with shim.efi.
If set my reorder.service at startup and exit, boot option in EFI list is only that not signed (grubx64.efi), the other is missing.
I mean “openSUSE” but I should expect “opensuse- secureboot” (shim.efi).

I think that a video could be better to let you understand. Eheheh

14

Did you reinstall grub? Try and turn off secure boot. After changing grub configuration files always run the following:

**erlangen:~ #** grub2-install  
Installing for x86_64-efi platform. 
Installation finished. No error reported. 
**erlangen:~ #** update-bootloader  
**erlangen:~ #**

Note: No further messages whatsoever!

If set my reorder.service at startup and exit, boot option in EFI list is only that not signed (grubx64.efi), the other is missing. I mean “openSUSE” but I should expect “opensuse- secureboot” (shim.efi).

Turn that off and make sure it doesn’t get invoked inadvertently.

15

So what happens if you turn it off?

the first startup after the self-boot reorder is with grubx64.efi and not with shim.efi

Did you use this system without Secure Boot in the past? Have you ever run grub2-install (which is rather bad advice on openSUSE)?

Are you sure Secure Boot is really enabled? Because grubx64.efi is not signed and should not boot with SB on.

Show output of

efibootmgr -v
mokutil --sb-state  
mokutil --list-enrolled

(upload to https://susepaste.org)

It really sounds like some security feature of your BIOS that detects “breach attempt” and restores “last known good configuration”.

There was at least one known case when Linux driver caused NVRAM to become read-only so no change could be permanently saved.

I think that a video could be better to let you understand. Eheheh

Well, it may. But at least tell what system you have (vendor, model, BIOS version …)

16

I made a new installation and I disabled Secure Boot and NVRAM update during installation setup. I dind’t disable secureboot before because I thought that was necessary for bitlocker.

Now all is working! Thanks you very much!