You are not logged in.
Hello, after over 20 hours of trying to fix my problem with exactly no progress, I hope that anyone has an idea for me.
I run arch with current updates.
I have full disk encryption with LUKS1, similar to the setup described in "Encrypted boot partition (GRUB)".
To be precise:
/dev/sda1 (mounted to /efi) is my EFI partition (unencrypted)
/dev/sda2 (UUID: 885f0c4e-0ac3-...) is a LUKS 1 encrypted Partition. Let's call it cryptlvm
Inside the cryptlvm is a LVM with a single volumegroup (called t45)
The VG t45 has the UUID WcGvED-Lxfv-... (based on vgs -v)
The voloumgroup t45 has several Logical volumes, of which the following are important:
- t45-swap
- t45-root (mounted to /) (UUID: XJQhB6-zsPJ-...)
- t45-home (mounted to /home)
Note: I have no external /boot partition. It is part of the LV t45-root wich is encrypted.
Note: different from the documentation in "Encrypted boot partition (GRUB)", I have no BIOS boot partition, because I boot in UEFI-mode only.
I also followed the instruction in the Section "Avoiding having to enter the passphrase twice".
Whenever the wiki-page gave an alternative to use the sd-encrypt hook, I choose it.
/dev/sda uses GUID Partition Table (GPT).
I use the Bootmanager Grub 2.
This setup worked for me for several years.
/etc/default/grub:
GRUB_DEFAULT=0
GRUB_TIMEOUT=1
GRUB_DISTRIBUTOR="Arch"
GRUB_CMDLINE_LINUX_DEFAULT="loglevel=3 quiet intel_idle.max_cstate=3"
GRUB_CMDLINE_LINUX="rd.luks.name=885f0c4e-0ac3-...=cryptlvm rd.luks.key=885f0c4e-0ac3-...=/root/cryptlvm.keyfile resume=/dev/t45/swap"
# I also tried the following with no success:
# GRUB_CMDLINE_LINUX="rd.luks.name=885f0c4e-0ac3-...=cryptlvm rd.luks.key=885f0c4e-0ac3-...=/root/cryptlvm.keyfile resume=/dev/t45/swap root=/dev/t45/root"
GRUB_PRELOAD_MODULES="part_gpt part_msdos"
# I also tried the following with no success:
# GRUB_PRELOAD_MODULES="part_gpt part_msdos lvm mdraid09 mdraid1x cryptodisk luks"
GRUB_ENABLE_CRYPTODISK=y
GRUB_TIMEOUT_STYLE=menu
GRUB_TERMINAL_INPUT=console
GRUB_GFXMODE=auto
/etc/mkinitcpio.conf:
MODULES=()
BINARIES=()
FILES=(/root/cryptlvm.keyfile)
HOOKS=(base udev systemd autodetect keyboard sd-vconsole modconf block sd-encrypt lvm2 filesystems fsck)
# I also tried the following with no success:
#HOOKS (base systemd autodetect keyboard sd-vconsole modconf block sd-encrypt lvm2 filesystems fsck)
After I rebooted from a working system, and entered my LUKS password, I was greeted with the GRUB error:
Enter passphrase for hd0,gpt2 (88f0c4e-0ac3-...):
Attempting to decrypt master key...
Slot 0 opened
error: disk `lvmid/WcGvED-Lxfv-.../XJQhB6-zsPJ-...` not found.
Entering rescue mode...
grub rescue>
What I have done
As far as I can undertand the situation, grub is able to handle/decrypt LUKS 1 /dev/sda2 just fine. The issue seems to be something with LVM.
The Path of the lvmid that grub can't find matches the path to the LV t45-root.
I can boot via the arch-iso.
I then can decrypt /dev/sda2 (cryptsetup luksOpen /dev/sda2 cryptlvm)
I mount the following:
- /dev/mapper/t45-root > /mnt
- /dev/mapper/t45-home > /mnt/home
- /dev/sda1 > /mnt/efi
With arch-chroot /mnt I can enter the system.
Inside the system, I tried several /etc/mkinitcpio.conf and /etc/default/grub configurations (see commented part).
Reinstalling the packets grub, linux and linux-headers does not solve my issue.
Whenever I run `grub-install --target=x86_64-efi --efi-directory=/efi --bootloader-id=GRUB --recheck`
I get the error
grub-install: error: disk 'lvmid/WcGvED-Lxfv-.../XJQhB6-zsPJ-...' not found.
Whenever I run `grub-mkconfig -o /boot/grub/grub.cfg`
I get the error:
/user/bin/grub-probe: error: disk 'lvmid/WcGvED-Lxfv-.../XJQhB6-zsPJ-...' not found.
The command `mkinitcpio -p linux` has only the "usual warnings" for missing firmwares, and exits with `Image generated successful`
In one desperate attempt to solve the Issue, I cleared the existing GRUB entry from the UEFI boot manager with `efibootmgr -B -b 12` where 12 was the ID of the GRUB entry.
Because grub-install fails, I have no Grub-entry in the UEFI boot manager anymore.
As far as I can see, some people who had the `disk not found` error tried to use LUKS Version 2 with Grub. I made sure to check, that /dev/sda2 is still Luks Version 1.
I can not see what changed to cause this problem. I didn't even update the system in the session before the error occurred.
And I can not understand why grub can know that the root-partition is t45-root, but on the other hand can't find it. (But that Is just my limited understanding of Grub).
If you have any tips, suggestion or anything I can look into, I would really appreciate it. My knowledge is at its limit.
Thank you.
Last edited by user371 (2023-05-11 22:22:18)
Offline
This seems to be a complex error.
After days of no working Laptop, frustration and hate, I came to the conclusion that an encrypted initramfs-linux is probably worth nothing at all. And since GRUB has no LUKS2 support, and LUKS1 is now insecure https://mjg59.dreamwidth.org/66429.html, I don't want to use GRUB anyway.
I can now use systemd-boot (as backup) and UEFI Firmware Boot Manager directly (my 1st. choice).
I may look into on how to encrypt initramfs later.
Last edited by user371 (2023-05-13 16:47:35)
Offline