Update Kernel & Remove older Kernel = Panic at boot LUKS password prompt

Running KDE Plasma variant here since January 2023.
Updates have been okay.
Today ran updates, then got popup that I had an older non-supported kernel.
I went into Kernels, installed recent 6.4 and removed older kernel.
Now when I boot, instead of getting my ususal LUKS password prompt for my boot partition, I am getting a flashing CAPS Lock key / kernel panic…

Am looking for guidance to boot and fix LUKS problem.
Then looking for a way to get the older kernel installed that LUKS can work with…

Currently I see only this when I power on:
/dev/nvme0n1p2: recovering journal
/dev/nvme0n1p2: clean, 572908/4161536 files, 11676676/16626432 blocks
THEN THE CAPS LOCK FLASHES

I am not sure that the new kernel is your problem, but if it is, than just use live-usb, boot from there, chroot and install another kernel with mhwd-kernel.
The current lts kernel is linux61.
(mhwd-kernel -i linux61)

Just a point of information …
I know the dialogue from msm-notifier is less than desirable … but you dont have any reason to be on the 6.4 kernel.
If you had an actual EOL kernel, such as 6.2 you might need to remove that … but it doesnt mean you need to use the absolute latest kernel.
You can see kernels and their projected lifetimes here: The Linux Kernel Archives - Releases
Also … its generally a bad idea to attempt removal of a running kernel.
You should:

  • A - Install whatever other kernel you like
  • B - Boot into another kernel
  • C - Remove undesired kernel

I was able to do this.

I found that I had to
sudo mhwd-kernel --remove linux64

then
sudo update-grub

then it rebooted to a linux 6.3 kernel that LUKS was okay with.

Thanks all for your guidance :slight_smile:

Manjaro tricked me again.

Pop up came up that I was running an unsupported kernel.

I went into kernel and selected the 6.4 RealTime kernel.

Rebooted.

And sure enough - Kernel Panic
As the newer kernel is not compatible with LUKS.

This is terrible - does this mean the LUKS is not going to be supported in the future?

I can’t even remember how I fixed this from before…

I am down and am scrambling to find a solution.

Do not install realtime kernels without really needing one (if you don’t know the difference - you don’t need it).
Besides, kernel 6.4 is soon going to be EOL, so you can install the brand new 6.5 that just came out. Or just stay on LTS 6.1. Actually you should always have at least 2 kernels, one of which LTS if something goes wrong, for example with an update.

How do I know when it is safe to install a newer Kernel?
Currently I am running 6.1.92-1 but I noticed that 6.6.32-1 is LTS.

I have a 12th Gen Intel with newer hardware, and hope to be able to SOMEDAY use the laptop camera and thumbprint reader.

Is there a kernel compatibility chart for LUKS?

Its just about always safe to install a new kernel.

You can have multiple installed.

And its prudent to remove stale and deprecated ones.

But I generally find it a good idea to keep at least one known working LTS (6.1 in your case) plus whatever else I may be testing or using.

So you can simply install 6.6, and 6.9 while you are at it, and select your desired kernel at GRUB during boot.

Maybe after using those for some time you will feel comfortable removing 6.1, but you dont have to any time soon. 6.1 will be supported until about the end of 2026.

They are all equally capable.

So I am afraid to move to the next LTS kernel because of past experience with Kernel Panic when doing so.

Furthermore, even if I did progress to the newer LTS kernel

  • I keep forgetting and have to spend hours to figure out how to roll back…

You will have two installed and you can easily switch at boot time.

I am back again.
This time I allowed Manjaro to do updates and it seems to have loaded kernel 6.6
I did what I used to do and pressed ESC to boot off of 6.1 and set the default boot to 6.1.
Today - when I select 6.1 - it fails to boot and says:
“Failed to start Cryptography Setup for luks-”

It almost seems that LUKS does not work on any of the newer kernels.
Now, the 6.1 that I do have does not even work.

What can I do? everything I have is encrypted… Though most is backed up - but I have large amounts that is not, because I don’t have anything to back it up to.

I am at the end of the road with LUKS.
If I get this back up - I promise to move everything to unencrypted.
It’s too bad there is not any reliable encryption out there that does not has problems.

But maybe it didn’t. What do you mean by:
“it seems to have loaded”?

We don’t know what that is. What did you do?

If the system fails to boot with either one of the kernels you have,
you can only fix your systen through chroot (manjaro-chroot).

You can access the data by simply booting from USB, open the encrypted container, mount the system and then copy / back up your data.

It is very reliable - we don’t know what you did during the update to lose the ability to boot.

It (pamac) did load linux66 - but I did not specify to do this.
Is there something I need to specify whenever I do a pamac update / pamac upgrade to keep pamac from messing with the kernel?

  • What I used to do is listed in the previous post:
    sudo mhwd-kernel --remove linux6X (X being the kernel newer than 6.1)
    sudo update-grub

So if I use LUKS, I am going to have to stay on Kernel 6.1 forever?

You mean: linux66 got installed without you wanting to do that?

I find that scenario very unlikely - but I do not use pamac
but pacman instead - and yay for AUR

No - not as long as the kernel version is supported by Manjaro.
You kernel doesn’t get messed with - the version stays the same.

Good to have two (or more) kernels installed - in case one decides to not work for some reason.

No.
That is the wrong conclusion.

If you now have only one Kernel and can’t boot your system with it - you need a bootable USB just like the one you used to install from.
Using this you can access your files and back them up
or you can chroot and rectify whatever the problem might be.



mhwd-kernel -li lists what you have
mhwd-kernel -l lists what is available to choose from
mhwd-kernel -i linuxXYZ installs one of the available choices

It’s good to have more than just one kernel installed …
Have at least one LTS Kernel installed - but even these will eventually become unsupported over time.
You need to keep an eye on that occasionally.

Just an update:

I have figured out that the “Failed to start Cryptography” error that I am getting is being caused by something (keyboard? fingerprint reader?) in my HP laptop initializing and causing false/ghost input at the LUKS password prompt.

My current workaround is:
Upon booting up, let this problem happen.
Enter my system/root password.
Type exit to return to LUKS.
Then at the LUKS password prompt, I enter the password and proceed with a normal system bootup.

Question:
Is there anything I can change in the LUKS config to either allow more password attempts or time - before being thrown a “Failed to start Cryptography” error?

No, not with a fully encrypted system like the Calamares installer creates it.
Grub promts you for the password in that case - and it is giving you only one try.
Not configurable to more.

And without configuration of your initrd, the kernel will act as if and assume a standard english keyboard.

It would be good if you knew what that something was - the fingerprint reader has been seen to have caused such issue.

Did you install another kernel - or even two - and test whether the issue is the same with one of them?