# Repair / recreate EFI boot entries

I setup my Lenovo ThinkPad X1 Carbon Gen 9 laptop to dual-boot between Windows and Linux. I recently had my laptop's motherboard / systemboard replaced, which wiped out the ability to boot into Linux. I had to use `efibootmgr` to create a new boot entry because the laptop's UEFI/BIOS screens don't allow me to do it (many server BIOS/UEFI allow creating boot entries though.)

## Procedure

1. Boot the laptop into a rescue environment
2. Query the variables
3. Create a new boot entry

### Boot into a rescue environment

The easiest way to do this is to use a Live ISO. I used a PXE server in my case. Either way, I append `inst.rescue` and `inst.sshd` for convenience.

  linuxefi  vmlinuz-f41  ip=dhcp inst.repo=https://dl.fedoraproject.org/pub/fedora/linux/releases/41/Everything/x86_64/os/ inst.rescue inst.sshd
  initrdefi initrd.img-f41

Starting installer, one moment...
anaconda 41.35-2.fc41 for Fedora 41 started.
 * installation log files are stored in /tmp during the installation
 * shell is available on TTY2 and in second TMUX pane (ctrl+b, then press 2)
 * when reporting a bug add logs from /tmp as separate text/plain attachments
================================================================================
================================================================================
Rescue

The rescue environment will now attempt to find your Linux installation and
mount it under the directory : /mnt/sysroot.  You can then make any changes
required to your system.  Choose '1' to proceed with this step.
You can choose to mount your file systems read-only instead of read-write by
choosing '2'.
If for some reason this process does not work choose '3' to skip directly to a
shell.



1) Continue
2) Read-only mount
3) Skip to shell
4) Quit (Reboot)

Please make a selection from the above: 


[anaconda]1:main* 2:shell  3:log  4:storage-log  5:program-log  6:packaging-log    Switch tab: Alt+Tab | Help: F1    

:::info
The Rescue environment automatically detected my Linux installation on `/dev/nvme0n1p6`, but I still need to provide the LUKS decryption passphrase.
:::

Please make a selection from the above: 1
================================================================================
================================================================================
Password

                                   nvme0n1p6

Passphrase: **********
================================================================================
================================================================================
Rescue Shell

Your system has been mounted under /mnt/sysroot.

If you would like to make the root of your system the root of the active system,
run the command:

        chroot /mnt/sysroot

Warning: The rescue shell will trigger SELinux autorelabel on the subsequent
boot. Add "enforcing=0" on the kernel command line for autorelabel to work
properly.
When finished, please exit from the shell and your system will reboot.

Please press ENTER to get a shell: 

### Query the variables

:::info
The first thing I do in the Rescue environment is `chroot /mnt/sysroot`
:::

Please press ENTER to get a shell: 
bash-5.2# 
bash-5.2# chroot /mnt/sysroot
bash-5.2# 
bash-5.2# lsblk -o +FSTYPE,PARTLABEL
NAME                               MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS FSTYPE      PARTLABEL
loop0                                7:0    0 702.8M  1 loop              squashfs    
zram0                              252:0    0     8G  0 disk  [SWAP]                  
nvme0n1                            259:0    0 476.9G  0 disk                          
├─nvme0n1p1                        259:7    0   100M  0 part  /boot/efi   vfat        EFI System Partition
├─nvme0n1p2                        259:8    0    16M  0 part                          Microsoft reserved partition
├─nvme0n1p3                        259:9    0 194.3G  0 part              ntfs        Basic data partition
├─nvme0n1p4                        259:10   0   950M  0 part              ntfs        
├─nvme0n1p5                        259:11   0     1G  0 part  /boot       ext4        
└─nvme0n1p6                        259:12   0 280.6G  0 part              crypto_LUKS 
  └─luks-4700b633-5c96-4b10-95ce-9ad0acd91d42
                                   253:0    0 280.6G  0 crypt /           ext4        
bash-5.2# 

You must know the name of the disk (e.g. `/dev/sda`) and the path to an EFI-executable (e.g. `\EFI\fedora\grubx64.efi`)

The disk name is easy, because I only have one disk in my laptop (`/dev/nvme0n1`).

jcall@jcall-laptop:~$ lsblk -o +FSTYPE,PARTLABEL
NAME                                          MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS FSTYPE      PARTLABEL
zram0                                         252:0    0     8G  0 disk  [SWAP]                  
nvme0n1                                       259:0    0 476.9G  0 disk                          
├─nvme0n1p1                                   259:1    0   100M  0 part  /boot/efi   vfat        EFI System Partition
├─nvme0n1p2                                   259:2    0    16M  0 part                          Microsoft reserved partition
├─nvme0n1p3                                   259:3    0 194.3G  0 part              ntfs        Basic data partition
├─nvme0n1p4                                   259:4    0   950M  0 part              ntfs        
├─nvme0n1p5                                   259:5    0     1G  0 part  /boot       ext4        
└─nvme0n1p6                                   259:6    0 280.6G  0 part              crypto_LUKS 
  └─luks-4700b633-5c96-4b10-95ce-9ad0acd91d42 253:0    0 280.6G  0 crypt /           ext4        

:::warning
The path to an EFI-executable can be tricky. I'm not using Secure Boot, so I avoid `shim*.efi`. The path is relative to the filesystem root, not the mount point -- so remove the `/boot/efi` part of the path and replace `/`'s with `\`'s. The final result is `\EFI\fedora\grubx64.efi`
:::

bash-5.2# ls -1 /boot/efi/EFI/fedora/*.efi
/boot/efi/EFI/fedora/fwupdx64.efi
/boot/efi/EFI/fedora/grubx64.efi
/boot/efi/EFI/fedora/mmx64.efi
/boot/efi/EFI/fedora/shim.efi
/boot/efi/EFI/fedora/shimx64.efi

:::warning
Check if Secure Boot is enabled/disabled
:::

# mokutil --sb-state
SecureBoot disabled

### Create a new boot entry

Let `efibootmgr` do it's magic. I added some blank lines to the output below, and trimmed some useless lines.

# efibootmgr --create --disk /dev/nvme0n1 --loader "\EFI\fedora\grubx64.efi" --label "Fedora"

:::info
Confirm the new boot entry (`Boot0001`) and boot order (`0001,0000,...`)
:::

# efibootmgr
BootCurrent: 0001
Timeout: 2 seconds

BootOrder: 0001,0000,001A,001B,001C,001D,001E,001F,0020,0021,0022
Boot0000* Windows Boot Manager	HD(1,GPT,030bcf64-029d-4362-ae22-52b475395d5c,0x800,0x32000)/\EFI\Microsoft\Boot\bootmgfw.efi57494e444f5753000100000088000000780000004200430044004f0042004a004500430054003d007b00390064006500610038003600320063002d0035006300640064002d0034006500370030002d0061006300630031002d006600330032006200330034003400640034003700390035007d00000073730100000010000000040000007fff0400

Boot0001* Fedora	HD(1,GPT,030bcf64-029d-4362-ae22-52b475395d5c,0x800,0x32000)/\EFI\fedora\grubx64.efi

Boot0010  Setup	FvFile(721c8b66-426c-4e86-8e99-3457c46ab0b9)
Boot0011  Boot Menu	FvFile(126a762d-5758-4fca-8531-201a7f57f850)
Boot0012  Diagnostic Splash Screen	FvFile(a7d8d9a6-6ab0-4aeb-ad9d-163e59a7a380)
Boot0013  Lenovo Diagnostics	FvFile(3f7e615b-0d45-4f80-88dc-26b234958560)
Boot0014  Asset Information	FvFile(da465b87-a26f-4c12-b78a-0361428fa026)
... <several more lines omitted> ...

### Reboot

With the new boot entry created, and set to be the default boot entry, you can now reboot. `exit`ing the Rescue environment will trigger a reboot.

exit