Grub error: symbol 'grub_is_lockdown' after update

Hi there,

when booting my system grub goes into rescue mode with the message

“error: symbol ‘grub_is_lockdown’ not found”

What happened:
Recently I updated grub after reading this article: https://forum.manjaro.org/t/grub2-secure-boot-bypass-and-other-issues-update-highly-recommended/57280.
I’m using an EFI system so I followed the instructions in the corresponding section. No errors occurred so I went on to activate the os-prober because I have a dual boot system (Manjaro and Windows).

Now grub rescue mode shows up with the error message I mentioned above. I found this tutorial:
https://www.youtube.com/watch?v=QHe3-hF-Rdk

which I followed closely but when I enter

insmod normal

it only shows the same message:

normal error: symbol ‘grub_is_lockdown’ not found

I then tried the whole process of restoring grub (https://wiki.manjaro.org/index.php/GRUB/Restore_the_GRUB_Bootloader#Reinstall_GRUB). I don’t get any error messages and all seems fine but on reboot grub again goes into rescue mode with the same error message

error: symbol ‘grub_is_lockdown’ not found

I’m using the stable branch with the newest kernel. Both OSes are installed on the same drive (M2-SSD). Can you help me? Are there any infos I cna provide you with to help troubleshooting?

(Sorry for the odd formatting, I’m not allowed to include links in my posts :thinking:)

Hi there,

seems like this issue doesn’t occur that often. I guess I’m in bad luck? Anyway, I managed some progress:

Using the newest live ISO I’m able to boot into my manjaro installation again. Now, when I grub-mkconfig -o /boot/grub/grub.cfg the output contains some images which wasn’t the case before:

Generating grub configuration file ...
Found theme: /usr/share/grub/themes/manjaro/theme.txt
Found linux image: /boot/vmlinuz-5.11-x86_64
Found initrd image: /boot/amd-ucode.img /boot/initramfs-5.11-x86_64.img
Found initrd fallback image: /boot/initramfs-5.11-x86_64-fallback.img
Found linux image: /boot/vmlinuz-5.10-x86_64
Found initrd image: /boot/amd-ucode.img /boot/initramfs-5.10-x86_64.img
Found initrd fallback image: /boot/initramfs-5.10-x86_64-fallback.img
Found linux image: /boot/vmlinuz-5.4-x86_64
Found initrd image: /boot/amd-ucode.img /boot/initramfs-5.4-x86_64.img
Found initrd fallback image: /boot/initramfs-5.4-x86_64-fallback.img
Warning: os-prober will be executed to detect other bootable partitions.
It's output will be used to detect bootable binaries on them and create new boot entries.
Found Windows Boot Manager on /dev/nvme0n1p4@/efi/Microsoft/Boot/bootmgfw.efi
Adding boot menu entry for UEFI Firmware Settings ...
Found memtest86+ image: /boot/memtest86+/memtest.bin
/usr/bin/grub-probe: Warnung: Unbekannter Gerätetyp nvme0n1.
done

But at the end there is new warning: /usr/bin/grub-probe: Warning: unknown device type nvme0n1. (translated from German).

Now, when I try to boot manjaro from the disk I get the following output:

[FAILED] Failed to start Load Kernel Modules.
[FAILED] Failed to mount /boot/efi.
[DEPEND] Dependency failed for Local File Systems.
[FAILED] Failed to mount /mnt/Daten

And the system boots into emergency mode where I can log in as root or try to boot normally, which doenst’ work.

The output of journalctl -xb is very long. If it really helps solving the issue I’ll happily post it.

“Daten” is a mount point where I mounted a partition from another drive where I simply store lots of data. When booting via live-ISO, it just mounts trouble-free. But the othere 3 messages make me feel like I srewed up even more :frowning: Any help would be greatly appreciated!

I also can tell again which kernel I’m on: it’s 5.11.6-1. Changing the kernel in grub doesn’t change anything.

save your UEFI profile ( windows , linux )
recheck all options UEFI on your motherboard

in your UEFI

disable secure boot
disable fastboot
disks on AHCI
no legacy
no CSM
UEFI only or others ( not windows )

boot on USB iso manajro ( UEFi < USB vendor name > < partition 1 > )

open a teminal

inxi  -Mxa ( check for UEFI only , not UEFI[legacy] or Bios )
test -d /sys/firmware/efi && echo efi || echo bios
sudo parted -l
sudo efibootmgr -v

have you activated hibernation on windows ?
failed to mount /boot/efi means is this disk is locked ( as i supposed message error: symbol ‘grub_is_lockdown’ not found )

I have this experiencing the exact same problem, and I went through the same troubleshooting methods that OP did.

I updated my laptop today and it crashed before I could restart to finish the updating process. I then tried rebooting and it got stuck on the Manjaro loading screen, never reaching the gdm login screen (at this time GRUB was still working). During one of the boots I pressed ctrl+alt+f3 and it brought up a tty terminal. I decided to restore a recent Timeshift backup, however during the restore process I agreed to Timeshift reverting GRUB (which was a recommended setting). After Timeshift finished and I rebooted, I found that GRUB was broken and outputting the error message:

error: symbol ‘grub_is_lockdown’ not found

Luckily my laptop has the ability to boot from EFI files from the BIOS, so I can still boot into my Manjaro install. I booted into Manjaro and reinstalled GRUB (sudo pacman -Syy grub) and updated GRUB (sudo update-grub) and installed the configuration (sudo grub-install /dev/sda)but the problem still exists. Below are the following outputs.

sudo update-grub
Generating grub configuration file …
Found theme: /usr/share/grub/themes/manjaro/theme.txt
Found linux image: /boot/vmlinuz-5.10-x86_64
Found initrd image: /boot/intel-ucode.img /boot/initramfs-5.10-x86_64.img
Found initrd fallback image: /boot/initramfs-5.10-x86_64-fallback.img
Found linux image: /boot/vmlinuz-5.9-x86_64
Found initrd image: /boot/intel-ucode.img /boot/initramfs-5.9-x86_64.img
Found initrd fallback image: /boot/initramfs-5.9-x86_64-fallback.img
Warning: os-prober will be executed to detect other bootable partitions.
It’s output will be used to detect bootable binaries on them and create new boot entries.
Adding boot menu entry for UEFI Firmware Settings …
Found memtest86+ image: /boot/memtest86+/memtest.bin
done
sudo grub-install /dev/sda
Installing for x86_64-efi platform.
Installation finished. No error reported.

I was following this guide (GRUB/Restore the GRUB Bootloader - Manjaro) and there is a section that asks you to perform a full system update. However when performing this update, I ran into the same problem I was having before where Manjro gets stuck at the loading screen.

I used a USB live installer to run TImeshift to restore Manjaro, and now it’s working again, but I’m still stuck with the problem of a completely broken GRUB bootloader.

have you activated hibernation on windows ?

I have had hibernation disabled before I installed Manjaro.

inxi -Mxa
Machine:
Type: Laptop System: Hewlett-Packard product: HP ZBook 15 v: A3009DD10203
serial: Chassis: type: 10
serial:
Mobo: Hewlett-Packard model: 1909 v: KBC Version 94.56
serial: UEFI: Hewlett-Packard v: L70 Ver. 01.45
date: 04/17/2019

test -d /sys/firmware/efi && echo efi || echo bios
efi

sudo parted -l
Model: ATA CT500MX500SSD1 (scsi)
Disk /dev/sda: 500GB
Sector size (logical/physical): 512B/4096B
Partition Table: gpt
Disk Flags:
Number Start End Size File system Name Flags
1 2097kB 317MB 315MB fat32 boot, esp
2 317MB 500GB 500GB ext4
Model: ATA Samsung SSD 860 (scsi)
Disk /dev/sdb: 500GB
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Disk Flags:
Number Start End Size Type File system Flags
1 1049kB 500GB 500GB primary ntfs
Model: ATA ST500LT012-1DG14 (scsi)
Disk /dev/sdc: 500GB
Sector size (logical/physical): 512B/4096B
Partition Table: msdos
Disk Flags:
Number Start End Size Type File system Flags
1 1049kB 500GB 500GB primary ntfs
Model: ATA SAMSUNG MZMPD256 (scsi)
Disk /dev/sdd: 256GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags:
Number Start End Size File system Name Flags
1 1049kB 524MB 523MB ntfs Basic data partition hidden, diag
2 524MB 628MB 104MB fat32 EFI system partition boot, esp
3 628MB 645MB 16.8MB Microsoft reserved partition msftres
4 645MB 255GB 255GB ntfs Basic data partition msftdata
5 255GB 256GB 882MB ntfs hidden, diag
Model: SD ED2S5 (sd/mmc)
Disk /dev/mmcblk0: 128GB
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Disk Flags:
Number Start End Size Type File system Flags
1 16.8MB 128GB 128GB primary

sudo efibootmgr -v
BootCurrent: 0000
Timeout: 0 seconds
BootOrder: 0000,0001
Boot0000* Notebook Hard Drive BBS(HD,0x0)…
Boot0001* mSATA Drive BBS(HD,0x0)…
Boot0002* Dock Upgrade Bay BBS(HD,0x0)…
Boot0003* manjaro HD(1,GPT,f45b831d-4656-404f-8f15-adb4246efc60,0x1000,0x96000)/File(\EFI\manjaro\grubx64.efi)
Boot0004* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot0005* Windows Boot Manager HD(2,GPT,2dc259ab-0eb9-4b95-a5a0-ca5277e406b5,0xfa000,0x31800)/File(\EFI\Microsoft\Boot\bootmgfw.efi)WINDOWS…x…B.C.D.O.B.J.E.C.T.=.{.9.d.e.a.8.6.2.c.-.5.c.d.d.-.4.e.7.0.-.a.c.c.1.-.f.3.2.b.3.4.4.d.4.7.9.5.}…
Boot0006* Dock Upgrade Bay BBS(HD,0x0)…
Boot0007* Notebook Ethernet BBS(128,0x0)…E…
Boot0008* Notebook Hard Drive BBS(HD,0x0)…
Boot0009* mSATA Drive BBS(HD,0x0)…
Boot000A* mSATA Drive BBS(HD,0x0)…
Boot000B* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot000C* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot000D* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot000E* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot000F* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot0010* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot0011* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot0012* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot0013* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot0014* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot0015* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot0016* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot0017* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot0018* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot0019* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot001A* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot001B* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot001C* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot001D* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot001E* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot001F* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot0020* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot0021* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot0022* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot0023* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot0024* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot0025* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot0026* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot0027* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot0028* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot0029* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot002A* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot002B* opensuse-secureboot HD(1,GPT,5da520da-2f28-4e95-a305-94298bf5fecb,0x800,0xfa000)/File(\EFI\opensuse\shim.efi)
Boot002C* ubuntu HD(1,GPT,5363c819-1aa1-4229-9ee4-1380947b400d,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)
Boot002D* ubuntu HD(1,GPT,5363c819-1aa1-4229-9ee4-1380947b400d,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)
Boot002E* ubuntu HD(1,GPT,5363c819-1aa1-4229-9ee4-1380947b400d,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)
Boot002F* ubuntu HD(1,GPT,5363c819-1aa1-4229-9ee4-1380947b400d,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)
Boot0030* ubuntu HD(1,GPT,5363c819-1aa1-4229-9ee4-1380947b400d,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)
Boot0031* ubuntu HD(1,GPT,5363c819-1aa1-4229-9ee4-1380947b400d,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)
Boot0032* ubuntu HD(1,GPT,5363c819-1aa1-4229-9ee4-1380947b400d,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)
Boot0033* ubuntu HD(1,GPT,5363c819-1aa1-4229-9ee4-1380947b400d,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)
Boot0034* ubuntu HD(1,GPT,5363c819-1aa1-4229-9ee4-1380947b400d,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)
Boot0035* ubuntu HD(1,GPT,5363c819-1aa1-4229-9ee4-1380947b400d,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)
Boot0036* ubuntu HD(1,GPT,5363c819-1aa1-4229-9ee4-1380947b400d,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)
Boot0037* ubuntu HD(1,GPT,5363c819-1aa1-4229-9ee4-1380947b400d,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)
Boot0038* ubuntu HD(1,GPT,5363c819-1aa1-4229-9ee4-1380947b400d,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)
Boot0039* ubuntu HD(1,GPT,5363c819-1aa1-4229-9ee4-1380947b400d,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)
Boot003A* ubuntu HD(1,GPT,5363c819-1aa1-4229-9ee4-1380947b400d,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)
Boot003B* ubuntu HD(1,GPT,5363c819-1aa1-4229-9ee4-1380947b400d,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)
Boot003C* ubuntu HD(1,GPT,5363c819-1aa1-4229-9ee4-1380947b400d,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)
Boot003D* ubuntu HD(1,GPT,5363c819-1aa1-4229-9ee4-1380947b400d,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)
Boot003E* ubuntu HD(1,GPT,5363c819-1aa1-4229-9ee4-1380947b400d,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)
Boot003F* ubuntu HD(1,GPT,5363c819-1aa1-4229-9ee4-1380947b400d,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)
Boot0040* ubuntu HD(1,GPT,5363c819-1aa1-4229-9ee4-1380947b400d,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)
Boot0041* ubuntu HD(1,GPT,5363c819-1aa1-4229-9ee4-1380947b400d,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)

Hi Stephane, thanks for your reply!
I checked all UEFI-settings and changed them accordingly.

inxi -Mxa:

Machine: Type: Desktop System: Micro-Star product: MS-7C35 v: 1.0 serial:
Mobo: Micro-Star model: MEG X570 ACE (MS-7C35) v: 1.0 serial: UEFI: American Megatrends
v: 1.C0 date: 10/29/2020

test -d /sys/firmware/efi && echo efi || echo bios

efi

sudo parted -l

Modell: ATA Crucial_CT750MX3 (scsi)
Hard Disk /dev/sda: 750GB
Sector Size (logical/physical): 512B/512B
Partition Table: msdos
Disk-Flags:

Number Start End Size Type File System Flags
1 1049kB 494GB 494GB extended
5 2097kB 64,4GB 64,4GB logical ntfs
6 64,4GB 494GB 429GB logical ntfs
2 494GB 548GB 53,7GB primary ext4
3 548GB 655GB 107GB primary ext4
4 655GB 750GB 95,2GB primary linux-swap(v1)

Modell: ATA TOSHIBA HDWD120 (scsi)
Hard Disk /dev/sdb: 2000GB
Sector Size (logical/physical): 512B/4096B
Partition Table: gpt
Disk-Flags:

Number Start End Size Type File System Name Flags
1 1049kB 2000GB 2000GB ntfs msftdata

Modell: SanDisk Extreme Pro (scsi)
Hard Disk /dev/sdc: 128GB
Sector Size (logical/physical): 512B/512B
Partition Table: msdos
Disk-Flags:

Number Start End Size Type File System Flags
1 1049kB 128GB 128GB primary boot
2 128GB 128GB 33,6MB primary fat16 esp

Modell: Samsung SSD 970 EVO Plus 1TB (nvme)
Hard Disk /dev/nvme0n1: 1000GB
Sector Size (logical/physical): 512B/512B
Partition Table: gpt
Disk-Flags:

Number Start End Size Type File System Name Flags
3 17,4kB 1075MB 1075MB fat32 boot msftdata
1 1075MB 54,8GB 53,7GB ext4 manjaro
2 54,8GB 345GB 290GB ext4 home
4 345GB 345GB 105MB fat32 EFI system partition boot, versteckt, esp
5 345GB 345GB 16,8MB Microsoft reserved partition msftres
6 345GB 462GB 117GB ntfs Basic data partition msftdata
7 462GB 463GB 546MB ntfs versteckt, diag
8 463GB 1000GB 537GB ntfs Spiele msftdata

sudo efibootmgr -v

BootCurrent: 0004
Timeout: 1 seconds
BootOrder: 0004,0002,0000,0003
Boot0000* Windows Boot Manager HD(4,GPT,6808406d-072c-4755-bb3d-79bcf5cde389,0x28200800,0x32000)/File(\EFI\MICROSOFT\BOOT\BOOTMGFW.EFI)WINDOWS…x…B.C.D.O.B.J.E.C.T.=.{.9.d.e.a.8.6.2.c.-.5.c.d.d.-.4.e.7.0.-.a.c.c.1
.-.f.3.2.b.3.4.4.d.4.7.9.5.}…3…
Boot0002* manjaro HD(3,GPT,97285448-a5d1-8245-b1ec-295809f0d0cb,0x22,0x2007de)/File(\EFI\MANJARO\GRUBX64.EFI)
Boot0003* UEFI OS HD(3,GPT,97285448-a5d1-8245-b1ec-295809f0d0cb,0x22,0x2007de)/File(\EFI\BOOT\BOOTX64.EFI)…BO
Boot0004* UEFI: SanDisk Extreme Pro 0, Partition 2 PciRoot(0x0)/Pci(0x1,0x2)/Pci(0x0,0x0)/Pci(0x8,0x0)/Pci(0x0,0x3)/USB(7,0)/HD(2,MBR,0xf0763327,0xee70000,0x10000)…BO

I translated some terms into english. I hope I chose the correct english translations.

there is 2 partitions FAT boot , only one EFI

i encountered a similar issue after the last update, my solution
was to set efi-directory to only /boot/ instead of /boot/efi
No guaratntees though :wink: