Dear Maintainer,

My old laptop (Lenovo 11e) runs Sid and all was right before I updated
it the other day (I don't do that very often). After that upgrade, GRUB
wasn't able to load any kernel with the pretty much generic error
"Error: can't load image". The version of GRUB was 2.12~rc1-12.
If I try to boot again, GRUB tells me that I need to load the image
first (I guess it somehow ignores the linux command and sends that when
trying to load the initrd).

I tried to reinstall grub, grub-install /dev/sda, update-grub, reinstall
the kernel, update-initramfs from the rescue mode but nothing worked.
The "file" command was able to read the vmlinuz file and none seemed
truncated. The system has one partition with both / and /boot and isn't
running out of space.
I did not see any error message during those operation besides GRUB
saying it wasn't able to update EFI parameters.

I don't know if there is a way to get more logs or error message during
the boot explaining why it wasn't able to load the image.

I tried to get the last version of GRUB from Bookworm, that is
2.06-13, and now I'm able to boot. The kernel version did not change,
  the only change I did is to downgrade GRUB (and dependencies apt was
  asking for).

I'm not sure which GRUB package I should use for reporting so I took the
one that seems the most specific to my system. Apologies if it is not
correct.

Let me know if you need more info.

Thanks,

Hi Nicolas,

The mechanism used to load the kernel has changed from GRUB 2.06 to
GRUB 2.12, it is possible that there are unfortunate bugs in either in
GRUB and/or your firmware that is stopping the new mechanism from
loading the kernel.

Would you be able to attempt these two things to gather some information?

- Run `set debug=linux`, then `linux
PATH_TO_KERNEL_THAT_FAILS_TO_BOOT`. The output of the Linux command
should contain extra information with the debug mode enabled.

- (Make sure to have Secure Boot disabled), then run `rmmod peimage`
at the GRUB console, and then try running your boot entry (or
alternatively edit the boot entry with E and add that command on top).

Mate Kukri

Just as a point of comparison, I updated a Lenovo ThinkPad T470 from
2.12~rc1-11 to 2.12~rc1-12 today, and didn't see any trouble.

The boot log shows "Kernel is locked down from EFI Secure Boot", and the
initial system installation was done in January 2023 with 2.06-3~deb11u5
as the GRUB version (from "installer build 20210731+deb11u7+b1").

Hi Mate,

Sorry for the delay, I was abroad and wasn't able to work on your questions.

I tried to add the set debug=linux and the rmmod peimage by editing the
command list Debian deploys and this is what I get:

-------
    Booting a command line

error: no such module  <= I guess that's about the rmmod peimage
Loading Linux 6.5.0-4-and64 ...
loader/efi/linux.c:101:linux: UEFI stub kernel:
loader/efi/linux.c:102:linux: PE/COFF header @ 00000082
loader/efi/linux.c:128:linux: LoadFile2 initrd loading enabled
loader/efi/linux.c:495:linux: kernel file size: 9120128
loader/efi/linux.c:497:linux: kernel numpages: 2227
loader/efi/linux.c:514:linux: kernel @ 0x72a51000
Loading initial ramdisk ...
loader/efi/linux.c:416:linux: Using LoadFile2 initrd loading protocol

Press any key to continue...
-------

And that's it.
Let me know if you need me to do more tests.

Thanks

Good day,

does grub 2.12 (without rc1) help? There are a good pile of fixups
between rc1 and release. E.g.
https://git.savannah.gnu.org/cgit/grub.git/commit/?h=grub-2.12&id=1f5b180742ff2706bc3a696d115ddbc677ec75b9
or
https://git.savannah.gnu.org/cgit/grub.git/commit/?h=grub-2.12&id=67ae3981dc5113e5af3a0539174bcd7eab8f7722
could help.

Additionally, the ZFS fixes are needed to boot from volumes touched by
ZFS 2.2 ( https://github.com/openzfs/zfs/issues/13873 ), so migrating to
2.12 is helpful in either case.

Best regards,
Michael Fritscher

Hello,

Just letting you know that the 2.12 merge is in progress, and GRUB
2.12 (non-rc1) will be available in Debian the (hopefully) not too
distant future.

Mate

Hello Mate,

Thanks for letting us know. I just tried with 2.12~rc1-13 and no luck.
I'll wait for 2.12 and let you know if it fixes my issue.

Thanks,

Control: severity -1 important

I'm downgrading this bug severity, as a single system regressing in
boot ability is not release critical. It is not possible for us to
ensure that grub continues working on every single device out there,
this grub will work for more hardware than previous grubs, and blocking
the transition to testing because it doesn't work on your 11e is not
helping anyone.

We have now also uploaded 2.12-1 and of course we welcome any patches,
but an old Lenovo 11e is not a priority, and we don't have any to test
ourselves.

Hi Nicolas,

It might be worth double checking you have the latest BIOS/UEFI? If it's
not the latest, then updating is worth a try IMO.

FWIW I recently updated mine to resolve some (completely unrelated)
issues on my Lenovo Gen 1 X1 Carbon on Bookworm. With no optical drive
and no Windows, it initially seemed like a PITA, but ended up pretty easy.

Process went something like this:

- download relevant BIOS/UEFI update ISO specific to your model from
   Lenovo
- extract IMG from ISO (using 'geteltorito' tool in 'genisoimage' pkg)
- write IMG to USB (e.g. using 'dd')
- boot from USB
- update...! :)

If you are already running latest, updating doesn't help, or you want to
try a workaround, perhaps try disabling UEFI (i.e. disable secure boot
and enable "legacy BIOS only" mode) and install the non-uefi grub (i.e.
'grub-pc')?

Good luck.

Cheers,
Jeremy

Hello Julian,

I'm not sure why the aggressive tone here, I was asked if this bug
breaks my system and it does. How you want to handle this is up to you.
I think GRUB is a critical piece of a Linux system and I thought it was
worth to report the issue I encounter.

As I mentioned, my Lenovo isn't the newest one but it's not an esoteric
hardware either. It's a pretty regular amd64 laptop.

To be honest, I'm a bit concerned that GRUB failed where it wasn't
before (I would called that a regression) but also that it fails without
giving any error message or any kind of clue that could help to debug this.

I'm not a debian or ubuntu core developer and I don't know the first
thing about how to develop or debug a boot loader. Asking me for patches
isn't helping anyone.

If you have any suggestion in order to fix or just to diagnose the
issue, feel free to share that with me. Meanwhile, I'll try 2.12.1 and
look for an upgrade as Jeremy suggested.

Have a nice day,

Hello all,

An idea for a workaround I have on such machines is to add an
environment variable (or some other option) to GRUB that let's GRUB
use the legacy-x86 kernel entry point even if the EFI stub appears
supported (of course only with UEFI Secure Boot disabled).

Based on previous discussion, it unfortunately seems that this isn't
strictly a GRUB issue, and the problem comes from GRUB switching
to booting the kernel using the method now preferred by upstream.

Mate

Hi Jeremy,

Thanks for the suggestions.
I was able to update my BIOS/UEFI but it didn't solve the issue
unfortunately.

So I change the type of my UEFI partition to BIOS boot partition,
install grub-pc 2.12-1, run a grub-install and change the BIOS setting
to "legacy BIOS only" as you mentioned and I'm able to boot now.

I'm not sure of the consequences of switching from UEFI to BIOS, but at
least, I have a GRUB I don't need to pin to 2.06. :-)

Thanks again for your help.

Hello Mate,

As per Jeremy suggestion, I switched to BIOS/grub-pc and I'm now able to
boot my system. I guess this is not super ideal so I'll let you decide
if you want to keep this bug open or not.

If you need a tester for your idea, I can revert my system to UEFI and
give it a try whenever it's ready.

Thanks,

Hi Nicholas,

:(

If you haven't already, it may be worth reporting upstream (i.e. to grub
devs) - they might have more ideas on troubleshooting, etc?

Yay!

AFAIK, it just means that you aren't using secureboot/UEFI so the risk
of rootkits is potentially higher. TBH, I'm not sure how much risk there
really is in practice though?

FWIW, my laptop (a couple of years older than yours AFAIT) first had
Debian 6/Squeeze installed - about ~11-12 years ago & upgraded since -
has always been like that. IIRC I had to, to install Debian back then?

It's always been rock solid reliable and I've never had any issues
(beyond the odd Debian bug - at least to the best of my knowledge). I'm
always a bit paranoid though, so super careful - daily automated aide
scans, thunderbird with html disabled for email and firefox locked down
for web browsing - always careful with what links I click, etc. So YMMV!?

You're most welcome. Have an awesome day! :)

Cheers,
Jeremy

Dear Maintainer,

FYI, I experienced a pretty similar problem today:  failure to boot after
upgrading to 2.12-1.

Machine:  Lenovo Thinkpad T460p
   BIOS:  2.36 (initially)
          UEFI boot (without SecureBoot enabled)

Upon reboot, after showing the Lenovo splash screen, the system would just
drop into the BIOS setup screen.  My eventual workaround was to boot into
rescue-mode via a Debian 12.5 installer on a USB flashdrive and reinstall
the older grub (bookworm's 2.06-etc) from that.

I did upgrade the BIOS after that (from 2.36 -> 2.37, via fwupdmgr), but
I do not remember if I tried grub 2.12-1 again after that.  (By then, I was
just wanting to get some work done.)