Dear Maintainer,

   * What led up to the situation?

A Toshiba laptop with a single disk, with GPT partitions, a few days ago performed a normal upgrade:

...
2021-03-03 16:21:30 status installed man-db:amd64 2.9.4-2
2021-03-04 06:44:34 startup archives unpack
2021-03-04 06:44:34 upgrade grub2-common:amd64 2.04-15 2.04-16
2021-03-04 06:44:34 status half-configured grub2-common:amd64 2.04-15
2021-03-04 06:44:34 status unpacked grub2-common:amd64 2.04-15
2021-03-04 06:44:34 status half-installed grub2-common:amd64 2.04-15
2021-03-04 06:44:34 status triggers-pending man-db:amd64 2.9.4-2
2021-03-04 06:44:34 status unpacked grub2-common:amd64 2.04-16
2021-03-04 06:44:35 upgrade grub-efi-amd64:amd64 2.04-15 2.04-16
2021-03-04 06:44:35 status half-configured grub-efi-amd64:amd64 2.04-15
2021-03-04 06:44:35 status unpacked grub-efi-amd64:amd64 2.04-15
2021-03-04 06:44:35 status half-installed grub-efi-amd64:amd64 2.04-15
2021-03-04 06:44:35 status unpacked grub-efi-amd64:amd64 2.04-16
2021-03-04 06:44:35 upgrade grub-efi-amd64-bin:amd64 2.04-15 2.04-16
2021-03-04 06:44:35 status half-configured grub-efi-amd64-bin:amd64 2.04-15
2021-03-04 06:44:35 status unpacked grub-efi-amd64-bin:amd64 2.04-15
2021-03-04 06:44:35 status half-installed grub-efi-amd64-bin:amd64 2.04-15
2021-03-04 06:44:35 status unpacked grub-efi-amd64-bin:amd64 2.04-16
2021-03-04 06:44:35 upgrade grub-common:amd64 2.04-15 2.04-16
2021-03-04 06:44:35 status half-configured grub-common:amd64 2.04-15
2021-03-04 06:44:35 status unpacked grub-common:amd64 2.04-15
2021-03-04 06:44:35 status half-installed grub-common:amd64 2.04-15
2021-03-04 06:44:36 status unpacked grub-common:amd64 2.04-16
2021-03-04 06:44:36 startup packages configure
2021-03-04 06:44:36 configure grub-common:amd64 2.04-16 <none>
2021-03-04 06:44:36 status unpacked grub-common:amd64 2.04-16
2021-03-04 06:44:36 status half-configured grub-common:amd64 2.04-16
2021-03-04 06:44:36 status installed grub-common:amd64 2.04-16
2021-03-04 06:44:36 configure grub-efi-amd64-bin:amd64 2.04-16 <none>
2021-03-04 06:44:36 status unpacked grub-efi-amd64-bin:amd64 2.04-16
2021-03-04 06:44:36 status half-configured grub-efi-amd64-bin:amd64 2.04-16
2021-03-04 06:44:36 status installed grub-efi-amd64-bin:amd64 2.04-16
2021-03-04 06:44:36 configure grub2-common:amd64 2.04-16 <none>
2021-03-04 06:44:36 status unpacked grub2-common:amd64 2.04-16
2021-03-04 06:44:36 status half-configured grub2-common:amd64 2.04-16
2021-03-04 06:44:36 status installed grub2-common:amd64 2.04-16
2021-03-04 06:44:36 configure grub-efi-amd64:amd64 2.04-16 <none>
2021-03-04 06:44:36 status unpacked grub-efi-amd64:amd64 2.04-16
2021-03-04 06:44:36 status half-configured grub-efi-amd64:amd64 2.04-16
2021-03-04 06:44:49 status installed grub-efi-amd64:amd64 2.04-16
2021-03-04 06:44:49 trigproc man-db:amd64 2.9.4-2 <none>
2021-03-04 06:44:49 status half-configured man-db:amd64 2.9.4-2
2021-03-04 06:44:50 status installed man-db:amd64 2.9.4-2
...

During the course of this upgrade, I was prompted to run:

$ /usr/share/debconf/fix_db.pl

Do to some debconf database corrupt (I believe the package which prompted this was either mysql-common or mariadb-common)

I recall some questions / answers related to linux (and potentially grub) being removed due to there being no corresponding question (or similiar)

   * What exactly did you do (or not do) that was effective (or
     ineffective)?

Rebooted on 7 Mar

   * What was the outcome of this action?

grub went into grub rescue mode and displayed:

error: symbol `grub_is_lockdown` not found

   * What outcome did you expect instead?

A reboot into a functioning system.


Currently, I am booting using a rescue CD and then entering commands to manually start the laptop

Dear Maintainer,

just wanted to report that the upgrade worked here flawless.

If any additional information is needed, let me know.

Dear Maintainer,


* Install / update to grub-common grub-pc grub-pc-bin grub2 grub2-common - version: 2.02+dfsg1-20+deb10u4
* Install 2.02+dfsg1-20+deb10u3 - system works again
* can not boot: ... grub_register_command_lockdown not found ...
* boot system

Hi,

The problem is not limited to amd64. I see this problem on arm64. On a
FreedomBox arm64 image, on a Raspberry Pi 3B+ (when booted with UEFI
firmware[1]) when grub efi packages are upgraded, boot fails with the
error 'symbol `grub_is_lockdown` not found'.

Links:
1) https://github.com/pftf/RPi3

Thanks,

In my case, after uninstalling and reinstalling grub-efi-arm64* and
grub?-common packages, everything worked well. This action installed
additional packages (like shim-signed?) that were not present before.

The problem surfaced after an upgrade, in my case, done using
unattended-upgrades. This may indicate that something that is supposed
to be in Depends: list is in Recommends: list.

I have something to add to this.  This morning I was writing up a
document on how to convert an existing Debian amd64 AWS VM to arm64
without reinstalling, which is something I was interested in doing in
the future to a fairly complex system install that I wasn't excited
about trying to reinstall/migrate.  Everything worked with the
conversion, except for the grub stage, grub failed to start on the ARM
instance and was stuck at the grub-rescue prompt.  When typing "insmod
normal", it shows the "symbol `grub_is_lockdown` not found" error.  I
managed to get it working by copying grub modules from an existing
Debian ARM VM over to it, I did that because I noticed that the modules
were of a newer version and a different size.

I'm not sure if the "grub-install" step was needed, but after
investigating I found that when I ran grub-install a standard
Debian-provided ARM AWS community instance and rebooted, the instance
fails to boot in the same way.

This is my document if you were interested, I mention the error in it:
https://ryan.thoryk.com/linux/arm_convert.html

Sorry for our long delay in replying to this.

In general, this means that grub-install is not installing to the place
that your firmware is actually booting from, which causes the core image
(installed to a file under /boot/efi/ on UEFI systems) to be out of sync
with the modules (installed to a subdirectory of /boot/grub/).  This is
much rarer on UEFI systems than on BIOS systems, but it's still possible
in some misconfigured cases.

Could you please attach the output of "sudo grub-install --debug", "sudo
efibootmgr -v", and "sudo find /boot/efi -ls"?

What commands are you using?
[...]

I notice that not all your partitions are mounted.  What's on partitions
1, 3, and 4?  ("sudo parted -s /dev/sda print" might help.)

Thanks,

Thanks for looking into this issue.

I did some investigating this morning for my situation, and found the
problem.  Your suggestion is what helped me.

The test case I had was that if you start a new Debian ARM VM on AWS,
and run grub-install on it, future boots fail, where they stop at the
rescue prompt and an "insmod normal" shows the error message.  In other
words, "grub-install" was breaking grub, which is pretty bad.

After some investigating I found that grub-install was writing the EFI
boot loader image (grubaa64.efi) to the wrong location on the system.
It should be installing into /boot/efi/EFI/BOOT but is putting it into
/boot/efi/EFI/debian.  Future boots fail because the loader image that
executes (the one in BOOT) is the older version and is out of sync with
the modules.

I tried deleting the /boot/efi/EFI/BOOT folder to see what would happen,
wondering if it would try to use the "EFI/debian" one, and after
rebooting the system was stuck in an EFI shell (couldn't find a boot
loader), so the "EFI/debian" folder is clearly wrong.  This could be
similar to what's happening with others on here.

EFI/debian is *NOT* wrong, it's the correct location for a system that
has working firmware which supports setting UEFI boot variables. If
you *also* need to write a copy of grub (etc.) to the removable media
location (EFI/boot) then that's supported as well by the Debian
packaging - run "dpkg-reconfigure grub-efi-arm64" and say yes when the
system asks about that.

Thanks for that suggestion, that explains the correct procedure in
resolving the issue.  What I'm trying to point out though (I tried
this), is that if you spin up a new Debian ARM VM on AWS, and run
"grub-install" *without* doing a dpkg-reconfigure, it results in an
unbootable system.  To recover the system, you have to attach the disk
on a different VM and replace the old boot loader image with the new
one, then it boots again.  After running the dpkg-reconfigure command
though like you suggested, it copied over the EFI boot image to the
"BOOT" folder, and also set the nvram variables to apparently boot from
the "debian" folder, so that solved the problem for me.  After doing
that, the system comes up after a reboot with the newer grub modules.

With others on here, the issue might have to do with the system
executing an older EFI boot image resulting in a module mismatch, like
what happened to me.  Your dpkg-reconfigure suggestion might fix their
issues too.

Hi Ryan,

So when you say "spin up a new Debian ARM VM on AWS", what exact image
are you using here? It sounds like the build process for that image
needs to be fixed to DTRT for the platform. Then you and other users
won't be bitten by this problem...

doesn't mean the issue was fixed later.  In AWS's community AMI section,
the main one I tried is listed as "debian-10-arm64-20200511-260".  When
you launch it, if you do a package upgrade it installs a newer version
of grub.  Then running a grub-install makes it unbootable.  If you do
the dpkg-reconfigure method, you have to choose "yes" to the "force
extra installation" question, if you choose "no", it won't boot anymore.

I tried launching a newer AMI, titled "debian-10-arm64-20210621-680",
and that one reboots fine if you do a "grub-install", but that's because
it didn't install a newer version of grub, since the packages are
recent.  I don't know what would happen if it installed a newer grub,
you might have to look into that.  In the boot folder the EFI boot
loader is listed as "/boot/efi/EFI/BOOT/BOOTAA64.EFI", there's no
"EFI/debian" folder.  I'm not sure what they did to generate the AMI image.

The AMI IDs I used are:
ami-00249fe66e0872181
and
ami-025a7500c83d92798

I didn't try the Marketplace one.

One thing to add to that - when I did a "grub-install" on the newer AMI,
it didn't write a "EFI/debian" folder, just an "EFI/BOOT" folder, which
means that it might be working properly.  If that's the case, then the
older instances are broken, which would affect existing systems.  I'm
not sure if a grub upgrade would change that or not.

Hi Colin,

No problem with the delay, I understand that life happens.

Please find attached the three commands you wanted:

1. sudo grub-install --debug
2. sudo efibootmgr -v
3. sudo find /boot/efi -ls

When the grub prompt comes up, I am booting by doing:

set linux = (hd0,gpt5)/boot/vmlinuz-5.8.0-2-amd64 root=/dev/sda5
initrd = (hd0,gpt5)/boot/initrd.img-5.8.0-2-amd64
boot

(actually I can not recall if it is "set linux =" or "linux = " at the
moment. but it is the same for both the linux and initrd lines)

$ sudo parted -s /dev/sda print
Model: ATA TOSHIBA THNSNS12 (scsi)
Disk /dev/sda: 128GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags:

Number  Start   End     Size    File system  Name
 Flags
 1      1049kB  473MB   472MB   ntfs         Basic data partition
 hidden, diag
 2      473MB   578MB   105MB   fat32        EFI system partition
 boot, esp
 3      578MB   595MB   16.8MB               Microsoft reserved partition
 msftres
 4      595MB   50.3GB  49.7GB  ntfs         Basic data partition
 msftdata
 5      50.3GB  65.3GB  15.0GB  ext4
 6      65.3GB  128GB   62.7GB  ext4

I've no idea about partitions 1 or 3; partition 4 is where my Windows
installation resides. It was resized many years ago.

HTH.

Thanks,
Anand

package grub-efi-amd64
found 984760 2.02+dfsg1-20+deb10u4
thanks

 Hello,

I also had this issue when upgrading from stretch to buster.
For me the BIOS allowed be to select the EFI image to boot, so I was
able to boot into the system that way, then the fix was to:

1) run again update-grub2 and
2) dpkg-reconfigure -plow grub-efi-amd64

After this the old FreeDOS images (HP diagnostics and FreeDOS) I have
were no longer booting via grub, but I kept them just in case and I
still can boot them via direct EFI image selection from BIOS.

Some info on my system:


eddy@aptonia:~ $ ll /dev/disk/by-id/
total 0
lrwxrwxrwx 1 root root 10 sep  2 14:44 dm-name-nmve-home -> ../../dm-1
lrwxrwxrwx 1 root root 10 sep  2 14:44 dm-name-nmve-lvcrypt -> ../../dm-3
lrwxrwxrwx 1 root root 10 sep  2 14:44 dm-name-nmve-root -> ../../dm-0
lrwxrwxrwx 1 root root 10 sep  2 14:44 dm-name-nmve-swap -> ../../dm-2
lrwxrwxrwx 1 root root 10 sep  2 14:44
dm-uuid-LVM-dszzt4JF4qOrlcZdVIM8pF8M4cwQBR3TCeJFI4DcmZKcD7dPi6cIdHpueQNgBHPY
-> ../../dm-3
lrwxrwxrwx 1 root root 10 sep  2 14:44
dm-uuid-LVM-dszzt4JF4qOrlcZdVIM8pF8M4cwQBR3TgemRtgdFDbSpUbPwRC2XuZlz0qd2TAe6
-> ../../dm-1
lrwxrwxrwx 1 root root 10 sep  2 14:44
dm-uuid-LVM-dszzt4JF4qOrlcZdVIM8pF8M4cwQBR3Thu3VxxfPFVJ2y1xVoBWopwxAdqh3RMNv
-> ../../dm-2
lrwxrwxrwx 1 root root 10 sep  2 14:44
dm-uuid-LVM-dszzt4JF4qOrlcZdVIM8pF8M4cwQBR3TLNIBeUak8X026nSToUE5QcrOpTfiuJfM
-> ../../dm-0
lrwxrwxrwx 1 root root 15 sep  2 14:44
lvm-pv-uuid-ZkjWrn-o4q3-wkB8-kvLh-k0L1-jRsM-9Wj11m -> ../../nvme0n1p5
lrwxrwxrwx 1 root root 13 sep  2 14:44 nvme-eui.ace42e008509e89f ->
../../nvme0n1
lrwxrwxrwx 1 root root 15 sep  2 14:44 nvme-eui.ace42e008509e89f-part1
-> ../../nvme0n1p1
lrwxrwxrwx 1 root root 15 sep  2 14:44 nvme-eui.ace42e008509e89f-part2
-> ../../nvme0n1p2
lrwxrwxrwx 1 root root 15 sep  2 14:44 nvme-eui.ace42e008509e89f-part3
-> ../../nvme0n1p3
lrwxrwxrwx 1 root root 15 sep  2 14:44 nvme-eui.ace42e008509e89f-part5
-> ../../nvme0n1p5
lrwxrwxrwx 1 root root 13 sep  2 14:44
nvme-SK_hynix_BC501_HFM256GDJTNG-8310A_NJ8CN75131210CU3L ->
../../nvme0n1
lrwxrwxrwx 1 root root 15 sep  2 14:44
nvme-SK_hynix_BC501_HFM256GDJTNG-8310A_NJ8CN75131210CU3L-part1 ->
../../nvme0n1p1
lrwxrwxrwx 1 root root 15 sep  2 14:44
nvme-SK_hynix_BC501_HFM256GDJTNG-8310A_NJ8CN75131210CU3L-part2 ->
../../nvme0n1p2
lrwxrwxrwx 1 root root 15 sep  2 14:44
nvme-SK_hynix_BC501_HFM256GDJTNG-8310A_NJ8CN75131210CU3L-part3 ->
../../nvme0n1p3
lrwxrwxrwx 1 root root 15 sep  2 14:44
nvme-SK_hynix_BC501_HFM256GDJTNG-8310A_NJ8CN75131210CU3L-part5 ->
../../nvme0n1p5
eddy@aptonia:~ $ ll /dev/disk/by-uuid/
total 0
lrwxrwxrwx 1 root root 10 sep  2 14:44
2615ddb7-eab6-428c-9291-c3245b41c1f3 -> ../../dm-2
lrwxrwxrwx 1 root root 15 sep  2 14:44 2C53-59FF -> ../../nvme0n1p2
lrwxrwxrwx 1 root root 10 sep  2 14:44
53ff31db-a553-42be-85ab-720ffcb070a7 -> ../../dm-0
lrwxrwxrwx 1 root root 10 sep  2 14:44
61f9b8c2-bc4d-46e4-8a2c-b1e443a54f48 -> ../../dm-3
lrwxrwxrwx 1 root root 15 sep  2 14:44 6A53-125B -> ../../nvme0n1p1
lrwxrwxrwx 1 root root 10 sep  2 14:44
714a3bfa-0c2e-4bb1-a800-407ed7bf0556 -> ../../dm-1
eddy@aptonia:~ $ cat /proc/mdstat
cat: /proc/mdstat: No such file or directory
eddy@aptonia:~ $ dpkg -l | grep grub-efi-amd64
ii  grub-efi-amd64                        2.02+dfsg1-20+deb10u4
           amd64        GRand Unified Bootloader, version 2 (EFI-AMD64
version)
ii  grub-efi-amd64-bin                    2.02+dfsg1-20+deb10u4
           amd64        GRand Unified Bootloader, version 2 (EFI-AMD64
modules)
ii  grub-efi-amd64-signed                 1+2.02+dfsg1+20+deb10u4
           amd64        GRand Unified Bootloader, version 2 (amd64
UEFI signed by Debian)

eddy@aptonia:~ $ cat /boot/grub/grub.cfg
#
# DO NOT EDIT THIS FILE
#
# It is automatically generated by grub-mkconfig using templates
# from /etc/grub.d and settings from /etc/default/grub
#

### BEGIN /etc/grub.d/00_header ###
if [ -s $prefix/grubenv ]; then
  set have_grubenv=true
  load_env
fi
if [ "${next_entry}" ] ; then
   set default="${next_entry}"
   set next_entry=
   save_env next_entry
   set boot_once=true
else
   set default="0"
fi

if [ x"${feature_menuentry_id}" = xy ]; then
  menuentry_id_option="--id"
else
  menuentry_id_option=""
fi

export menuentry_id_option

if [ "${prev_saved_entry}" ]; then
  set saved_entry="${prev_saved_entry}"
  save_env saved_entry
  set prev_saved_entry=
  save_env prev_saved_entry
  set boot_once=true
fi

function savedefault {
  if [ -z "${boot_once}" ]; then
    saved_entry="${chosen}"
    save_env saved_entry
  fi
}
function load_video {
  if [ x$feature_all_video_module = xy ]; then
    insmod all_video
  else
    insmod efi_gop
    insmod efi_uga
    insmod ieee1275_fb
    insmod vbe
    insmod vga
    insmod video_bochs
    insmod video_cirrus
  fi
}

if [ x$feature_default_font_path = xy ] ; then
   font=unicode
else
insmod part_msdos
insmod lvm
insmod ext2
set root='lvmid/dszzt4-JF4q-Orlc-ZdVI-M8pF-8M4c-wQBR3T/LNIBeU-ak8X-026n-SToU-E5Qc-rOpT-fiuJfM'
if [ x$feature_platform_search_hint = xy ]; then
  search --no-floppy --fs-uuid --set=root
--hint='lvmid/dszzt4-JF4q-Orlc-ZdVI-M8pF-8M4c-wQBR3T/LNIBeU-ak8X-026n-SToU-E5Qc-rOpT-fiuJfM'
 53ff31db-a553-42be-85ab-720ffcb070a7
else
  search --no-floppy --fs-uuid --set=root 53ff31db-a553-42be-85ab-720ffcb070a7
fi
    font="/usr/share/grub/unicode.pf2"
fi

if loadfont $font ; then
  set gfxmode=auto
  load_video
  insmod gfxterm
  set locale_dir=$prefix/locale
  set lang=ro_RO
  insmod gettext
fi
terminal_output gfxterm
if [ "${recordfail}" = 1 ] ; then
  set timeout=30
else
  if [ x$feature_timeout_style = xy ] ; then
    set timeout_style=menu
    set timeout=5
  # Fallback normal timeout code in case the timeout_style feature is
  # unavailable.
  else
    set timeout=5
  fi
fi
### END /etc/grub.d/00_header ###

### BEGIN /etc/grub.d/05_debian_theme ###
insmod part_msdos
insmod lvm
insmod ext2
set root='lvmid/dszzt4-JF4q-Orlc-ZdVI-M8pF-8M4c-wQBR3T/LNIBeU-ak8X-026n-SToU-E5Qc-rOpT-fiuJfM'
if [ x$feature_platform_search_hint = xy ]; then
  search --no-floppy --fs-uuid --set=root
--hint='lvmid/dszzt4-JF4q-Orlc-ZdVI-M8pF-8M4c-wQBR3T/LNIBeU-ak8X-026n-SToU-E5Qc-rOpT-fiuJfM'
 53ff31db-a553-42be-85ab-720ffcb070a7
else
  search --no-floppy --fs-uuid --set=root 53ff31db-a553-42be-85ab-720ffcb070a7
fi
insmod png
if background_image
/usr/share/desktop-base/futureprototype-theme/grub/grub-16x9.png; then
  set color_normal=white/black
  set color_highlight=black/white
else
  set menu_color_normal=cyan/blue
  set menu_color_highlight=white/blue
fi
### END /etc/grub.d/05_debian_theme ###

### BEGIN /etc/grub.d/10_linux ###
function gfxmode {
    set gfxpayload="${1}"
}
set linux_gfx_mode=
export linux_gfx_mode
menuentry 'Debian GNU/Linux' --class debian --class gnu-linux --class
gnu --class os $menuentry_id_option
'gnulinux-simple-53ff31db-a553-42be-85ab-720ffcb070a7' {
    load_video
    insmod gzio
    if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
    insmod part_msdos
    insmod lvm
    insmod ext2
    set root='lvmid/dszzt4-JF4q-Orlc-ZdVI-M8pF-8M4c-wQBR3T/LNIBeU-ak8X-026n-SToU-E5Qc-rOpT-fiuJfM'
    if [ x$feature_platform_search_hint = xy ]; then
      search --no-floppy --fs-uuid --set=root
--hint='lvmid/dszzt4-JF4q-Orlc-ZdVI-M8pF-8M4c-wQBR3T/LNIBeU-ak8X-026n-SToU-E5Qc-rOpT-fiuJfM'
 53ff31db-a553-42be-85ab-720ffcb070a7
    else
      search --no-floppy --fs-uuid --set=root
53ff31db-a553-42be-85ab-720ffcb070a7
    fi
    echo    'Loading Linux 5.10.0-0.bpo.8-amd64 ...'
    linux    /boot/vmlinuz-5.10.0-0.bpo.8-amd64
root=/dev/mapper/nmve-root ro  quiet
    echo    'Loading initial ramdisk ...'
    initrd    /boot/initrd.img-5.10.0-0.bpo.8-amd64
}
submenu 'Advanced options for Debian GNU/Linux' $menuentry_id_option
'gnulinux-advanced-53ff31db-a553-42be-85ab-720ffcb070a7' {
    menuentry 'Debian GNU/Linux, with Linux 5.10.0-0.bpo.8-amd64'
--class debian --class gnu-linux --class gnu --class os
$menuentry_id_option
'gnulinux-5.10.0-0.bpo.8-amd64-advanced-53ff31db-a553-42be-85ab-720ffcb070a7'
{
        load_video
        insmod gzio
        if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
        insmod part_msdos
        insmod lvm
        insmod ext2
        set root='lvmid/dszzt4-JF4q-Orlc-ZdVI-M8pF-8M4c-wQBR3T/LNIBeU-ak8X-026n-SToU-E5Qc-rOpT-fiuJfM'
        if [ x$feature_platform_search_hint = xy ]; then
          search --no-floppy --fs-uuid --set=root
--hint='lvmid/dszzt4-JF4q-Orlc-ZdVI-M8pF-8M4c-wQBR3T/LNIBeU-ak8X-026n-SToU-E5Qc-rOpT-fiuJfM'
 53ff31db-a553-42be-85ab-720ffcb070a7
        else
          search --no-floppy --fs-uuid --set=root
53ff31db-a553-42be-85ab-720ffcb070a7
        fi
        echo    'Loading Linux 5.10.0-0.bpo.8-amd64 ...'
        linux    /boot/vmlinuz-5.10.0-0.bpo.8-amd64
root=/dev/mapper/nmve-root ro  quiet
        echo    'Loading initial ramdisk ...'
        initrd    /boot/initrd.img-5.10.0-0.bpo.8-amd64
    }
    menuentry 'Debian GNU/Linux, with Linux 5.10.0-0.bpo.8-amd64
(recovery mode)' --class debian --class gnu-linux --class gnu --class
os $menuentry_id_option
'gnulinux-5.10.0-0.bpo.8-amd64-recovery-53ff31db-a553-42be-85ab-720ffcb070a7'
{
        load_video
        insmod gzio
        if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
        insmod part_msdos
        insmod lvm
        insmod ext2
        set root='lvmid/dszzt4-JF4q-Orlc-ZdVI-M8pF-8M4c-wQBR3T/LNIBeU-ak8X-026n-SToU-E5Qc-rOpT-fiuJfM'
        if [ x$feature_platform_search_hint = xy ]; then
          search --no-floppy --fs-uuid --set=root
--hint='lvmid/dszzt4-JF4q-Orlc-ZdVI-M8pF-8M4c-wQBR3T/LNIBeU-ak8X-026n-SToU-E5Qc-rOpT-fiuJfM'
 53ff31db-a553-42be-85ab-720ffcb070a7
        else
          search --no-floppy --fs-uuid --set=root
53ff31db-a553-42be-85ab-720ffcb070a7
        fi
        echo    'Loading Linux 5.10.0-0.bpo.8-amd64 ...'
        linux    /boot/vmlinuz-5.10.0-0.bpo.8-amd64
root=/dev/mapper/nmve-root ro single
        echo    'Loading initial ramdisk ...'
        initrd    /boot/initrd.img-5.10.0-0.bpo.8-amd64
    }
    menuentry 'Debian GNU/Linux, with Linux 4.19.0-17-amd64' --class
debian --class gnu-linux --class gnu --class os $menuentry_id_option
'gnulinux-4.19.0-17-amd64-advanced-53ff31db-a553-42be-85ab-720ffcb070a7'
{
        load_video
        insmod gzio
        if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
        insmod part_msdos
        insmod lvm
        insmod ext2
        set root='lvmid/dszzt4-JF4q-Orlc-ZdVI-M8pF-8M4c-wQBR3T/LNIBeU-ak8X-026n-SToU-E5Qc-rOpT-fiuJfM'
        if [ x$feature_platform_search_hint = xy ]; then
          search --no-floppy --fs-uuid --set=root
--hint='lvmid/dszzt4-JF4q-Orlc-ZdVI-M8pF-8M4c-wQBR3T/LNIBeU-ak8X-026n-SToU-E5Qc-rOpT-fiuJfM'
 53ff31db-a553-42be-85ab-720ffcb070a7
        else
          search --no-floppy --fs-uuid --set=root
53ff31db-a553-42be-85ab-720ffcb070a7
        fi
        echo    'Loading Linux 4.19.0-17-amd64 ...'
        linux    /boot/vmlinuz-4.19.0-17-amd64
root=/dev/mapper/nmve-root ro  quiet
        echo    'Loading initial ramdisk ...'
        initrd    /boot/initrd.img-4.19.0-17-amd64
    }
    menuentry 'Debian GNU/Linux, with Linux 4.19.0-17-amd64 (recovery
mode)' --class debian --class gnu-linux --class gnu --class os
$menuentry_id_option
'gnulinux-4.19.0-17-amd64-recovery-53ff31db-a553-42be-85ab-720ffcb070a7'
{
        load_video
        insmod gzio
        if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
        insmod part_msdos
        insmod lvm
        insmod ext2
        set root='lvmid/dszzt4-JF4q-Orlc-ZdVI-M8pF-8M4c-wQBR3T/LNIBeU-ak8X-026n-SToU-E5Qc-rOpT-fiuJfM'
        if [ x$feature_platform_search_hint = xy ]; then
          search --no-floppy --fs-uuid --set=root
--hint='lvmid/dszzt4-JF4q-Orlc-ZdVI-M8pF-8M4c-wQBR3T/LNIBeU-ak8X-026n-SToU-E5Qc-rOpT-fiuJfM'
 53ff31db-a553-42be-85ab-720ffcb070a7
        else
          search --no-floppy --fs-uuid --set=root
53ff31db-a553-42be-85ab-720ffcb070a7
        fi
        echo    'Loading Linux 4.19.0-17-amd64 ...'
        linux    /boot/vmlinuz-4.19.0-17-amd64
root=/dev/mapper/nmve-root ro single
        echo    'Loading initial ramdisk ...'
        initrd    /boot/initrd.img-4.19.0-17-amd64
    }
    menuentry 'Debian GNU/Linux, with Linux 4.9.0-16-amd64' --class
debian --class gnu-linux --class gnu --class os $menuentry_id_option
'gnulinux-4.9.0-16-amd64-advanced-53ff31db-a553-42be-85ab-720ffcb070a7'
{
        load_video
        insmod gzio
        if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
        insmod part_msdos
        insmod lvm
        insmod ext2
        set root='lvmid/dszzt4-JF4q-Orlc-ZdVI-M8pF-8M4c-wQBR3T/LNIBeU-ak8X-026n-SToU-E5Qc-rOpT-fiuJfM'
        if [ x$feature_platform_search_hint = xy ]; then
          search --no-floppy --fs-uuid --set=root
--hint='lvmid/dszzt4-JF4q-Orlc-ZdVI-M8pF-8M4c-wQBR3T/LNIBeU-ak8X-026n-SToU-E5Qc-rOpT-fiuJfM'
 53ff31db-a553-42be-85ab-720ffcb070a7
        else
          search --no-floppy --fs-uuid --set=root
53ff31db-a553-42be-85ab-720ffcb070a7
        fi
        echo    'Loading Linux 4.9.0-16-amd64 ...'
        linux    /boot/vmlinuz-4.9.0-16-amd64
root=/dev/mapper/nmve-root ro  quiet
        echo    'Loading initial ramdisk ...'
        initrd    /boot/initrd.img-4.9.0-16-amd64
    }
    menuentry 'Debian GNU/Linux, with Linux 4.9.0-16-amd64 (recovery
mode)' --class debian --class gnu-linux --class gnu --class os
$menuentry_id_option
'gnulinux-4.9.0-16-amd64-recovery-53ff31db-a553-42be-85ab-720ffcb070a7'
{
        load_video
        insmod gzio
        if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
        insmod part_msdos
        insmod lvm
        insmod ext2
        set root='lvmid/dszzt4-JF4q-Orlc-ZdVI-M8pF-8M4c-wQBR3T/LNIBeU-ak8X-026n-SToU-E5Qc-rOpT-fiuJfM'
        if [ x$feature_platform_search_hint = xy ]; then
          search --no-floppy --fs-uuid --set=root
--hint='lvmid/dszzt4-JF4q-Orlc-ZdVI-M8pF-8M4c-wQBR3T/LNIBeU-ak8X-026n-SToU-E5Qc-rOpT-fiuJfM'
 53ff31db-a553-42be-85ab-720ffcb070a7
        else
          search --no-floppy --fs-uuid --set=root
53ff31db-a553-42be-85ab-720ffcb070a7
        fi
        echo    'Loading Linux 4.9.0-16-amd64 ...'
        linux    /boot/vmlinuz-4.9.0-16-amd64
root=/dev/mapper/nmve-root ro single
        echo    'Loading initial ramdisk ...'
        initrd    /boot/initrd.img-4.9.0-16-amd64
    }
}

### END /etc/grub.d/10_linux ###

### BEGIN /etc/grub.d/20_linux_xen ###

### END /etc/grub.d/20_linux_xen ###

### BEGIN /etc/grub.d/30_os-prober ###
menuentry 'FreeDOS (on /dev/nvme0n1p1)' --class freedos --class os
$menuentry_id_option 'osprober-chain-6A53-125B' {
    insmod part_msdos
    insmod fat
    if [ x$feature_platform_search_hint = xy ]; then
      search --no-floppy --fs-uuid --set=root  6A53-125B
    else
      search --no-floppy --fs-uuid --set=root 6A53-125B
    fi
    parttool ${root} hidden-
    drivemap -s (hd0) ${root}
    chainloader +1
}
menuentry 'FreeDOS (on /dev/nvme0n1p2)' --class freedos --class os
$menuentry_id_option 'osprober-chain-2C53-59FF' {
    insmod part_msdos
    insmod fat
    if [ x$feature_platform_search_hint = xy ]; then
      search --no-floppy --fs-uuid --set=root  2C53-59FF
    else
      search --no-floppy --fs-uuid --set=root 2C53-59FF
    fi
    parttool ${root} hidden-
    drivemap -s (hd0) ${root}
    chainloader +1
}
### END /etc/grub.d/30_os-prober ###

### BEGIN /etc/grub.d/30_uefi-firmware ###
menuentry 'System setup' $menuentry_id_option 'uefi-firmware' {
    fwsetup
}
### END /etc/grub.d/30_uefi-firmware ###

### BEGIN /etc/grub.d/40_custom ###
# This file provides an easy way to add custom menu entries.  Simply type the
# menu entries you want to add after this comment.  Be careful not to change
# the 'exec tail' line above.
### END /etc/grub.d/40_custom ###

### BEGIN /etc/grub.d/41_custom ###
if [ -f  ${config_directory}/custom.cfg ]; then
  source ${config_directory}/custom.cfg
elif [ -z "${config_directory}" -a -f  $prefix/custom.cfg ]; then
  source $prefix/custom.cfg;
fi
### END /etc/grub.d/41_custom ###

I've run into the same issue on upgrading from Stretch to Buster.

After upgrade everything worked and even reboots went fine.

then I decided to upgrade from Buster to Bullseye.

When I did that I did an update and upgrade of packages to prepare for the
OS upgrade.

When I rebooted from that process I got the error above.

I'm completely stuck.

I'm at the grub rescue prompt and I have no idea how to proceed from here.

I've done searches everywhere I can think to look and there seems no
definitive way to recover from this.

What do I need to do to recover?

severity 984760 normal
thanks

Seems like this is a bug in an old version, or only affecting "old"
installs with some incorrect state causing upgrades to not upgrade
the boot bits.

I'm downgrading this, under the assumption that if it would be a
massively wide-spread problem, it would have been fixed/worked on.

Chris

AFAIK it may affect any version upgrade. It should be less frequent with
the widespread use of a monolithic EFI signed image on architectures
which provide it.

Definitely. Or user error such as running grub-install without
--removable or --force-extra-removable on a system which relies on the 
removable media path.