Ubuntu not booting and initial ramdisk not loading

[Shrimpoodle]

I am not an advanced user. Ubuntu is the only operating system I use. 6 days ago Ubuntu said I needed to update my UEFI to the 2023 version, so i did. After i restarted, it said it still needed to update, so i clicked on it again. But this time the update took a lot longer and seemed stuck so i just canceled it for now.

I shut down my laptop and went to turn it on the next day, but it seemed like it froze after i tried to boot ubuntu. (I tried multiple times). So i entered the advanced options menu and clicked on recovery mode, but it got stuck on loading initial ramdisk. I used a live usb and clicked "try or install ubuntu" but it gave me a blank screen for several hours. Then i decided to go back to the gnu grub menu and check the memory, but it said "bad shim signature". then i realized i could just temporarily disable secure boot and use ubuntu to reinstall grub. So i went back to firmware settings (mine is insyde H2O BIOS) and disabled "enforce secure boot" since the regular secure boot setting was locked, but it seems like this did disable secure boot. It still didnt work. I did the memory test again but this time i got a blank screen. Using ls in the grub command line, i can only see .efi files. In the firmware settings there is nothing related to CPU.

All of the solutions i saw online either didnt match up to what grub showed me or they were too complex for me. If anyone could give me some advice about this i would really appreciate it.

 

[Alexzee]

You said you can only see the .efi files.
Can you see the /root partition?

Got Timeshift installed?
And, what kernel are you running now?

"Bad shim signature" means that the UEFI Secure Boot blocks the signature from loading because it can't verify the bootloader or the kernel.


With the Live usb up and running please post the output of this command.

sudo fdisk -l

(small letter L)

See here:

UEFI Secure Boot:- bad shim signature

Before proceeding I don't want to disable the Secure Boot option. I need a solution, not a workaround. I have a humble setup using dnsmasq and the dnsmasq built-in tftp to give me a PXE server. I am

askubuntu.com

Our members @bob466 and @Condobloke may be able to help.

 

[Condobloke]

G'day Shrimpoodle, Welcome to Linux.org

Which version of Ubuntu is this ?



Did you see an error?..... anything like;
Failed to write-firmware: failed to write (null): failed to write data to efivarsfs: Error writing to file descriptor: Invalid argument

?

Can you still boot to the live usb ?
Is there anything you need to save?....(music/data/files etc etc ?)

If there is I would save it to an external drive....Now.

I think you may need to reinstall.

Give us some detail about your pc, Laptop?....RAM, make and model?...as much as you can, Please.

If you choose to reinstall, I would install Linux Mint

But first, give us as much detail as you can.

 

[bob466]

Welcome to the Forum.

I'd download Linux Mint.
Depending on your computer specs...I'd try Mint xfce 22.3...I have 22.1 running on my old Laptop. Secure Boot must be disabled to run any Linux Distro otherwise it will cause a lot of grief.

Trying to work out what's happened and how to fix it would take forever...it's much quicker to do the above.

 

[osprey]

Secure Boot must be disabled to run any Linux Distro otherwise it will cause a lot of grief.

The major linux distros ubuntu, debian, fedora, mint, support UEFI secure boot seamlessly out-of-the-box. Each distro uses a signed pre-bootloader named "shim" that provides trust to the operating system. Secure boot "just works" without blocking normal computer use. If by chance it doesn't work, then there are likely some specific issues generic to the particular system that would need to be investigated to find the cause of such an issue since in general, the shims supplied by distros work.

For ubuntu, there's info here: https://documentation.ubuntu.com/security/security-features/platform-protections/secure-boot/

For info on how to use secure boot for custom kernels or modules, see @f33dm3bits thread here:

Thread 'HowTo: Linux and Secure boot'

Jan 14, 2025

I know not everyone is a fan of secure-boot but I recently discovered an easy way to easily setup secure-boot
using a tool called "sbctl", which allowed me to use the Microsoft keys already in your UEFI to sign a custom kernel, but you can also enroll your own custom keys if you prefer to do that. I used the easy option which is using the Microsoft keys because I don't like headaches and over-complicating things when it can be done the easy way.

DISCLAIMER: I AM NOT RESPONSIBLE FOR BRICKING YOUR SYSTEM! DO AT YOUR OWN RISK!

This worked for me on my first try so this is actually...

• f33dm3bits
• Replies: 2
• Forum: Desktop

• 
• 

In relation to the original problem, @Shrimpoodle wrote:

After i restarted, it said it still needed to update, so i clicked on it again. But this time the update took a lot longer and seemed stuck so i just canceled it for now.

The problem with stopping an upgrade before it completes is that it leaves the system in a corrupted state because some applications may have been fully downloaded but only partially installed which makes them unusable. The metadata for such applications is likely to be incomplete or absent so the operating system doesn't know what it needs to know to run them. That includes the initial ramdisk.

Given the errors mentioned in post #1, the simplest solution for someone not well-versed in linux is to re-install the whole operating system from scratch.

 

[Condobloke]

The problem with stopping an upgrade before it completes is that it leaves the system in a corrupted state because some applications may have been fully downloaded but only partially installed which makes them unusable. The metadata for such applications is likely to be incomplete or absent so the operating system doesn't know what it needs to know to run them. That includes the initial ramdisk.

Given the errors mentioned in post #1, the simplest solution for someone not well-versed in linux is to re-install the whole operating system from scratch.

Totally agree with the above.

@Shrimpoodle ...take note of this ^^^

 

[f33dm3bits]

It might have to do with this.

disabled "enforce secure boot" since the regular secure boot setting was locked, but it seems like this did disable secure boot. It still didnt work. I

Given the errors mentioned in post #1, the simplest solution for someone not well-versed in linux is to re-install the whole operating system from scratch.

All of the solutions i saw online either didnt match up to what grub showed me or they were too complex for me. If anyone could give me some advice about this i would really appreciate it.

There's also this.

Microsoft Secure Boot certificates expire June 27—here's what that means for your old PC

Most PCs should continue working fine, even if they don't receive the updated certificates.

www.howtogeek.com

That would probably mean you would have to update your BIOS/UEFI by getting the latest version from your montherboard's website and updating via the BIOS/UEFI flashtool from within the BIOS/UEFI. Some hardware is supported by fwupd, but a lot isn't. So if it's still a secure-boot problem doing the first probably be good so that you know you have the latest firmware with the most update-to-date certificates. So what @osprey said is probably easiest for you as other solutions were already too complicated for you as you mentioned yourself already.

 

[bob466]

Everyone has an opinion on secure boot...Linux Mint supports it but do you want this type of trouble...
https://linuxmint-installation-guide.readthedocs.io/en/latest/efi.html

My Towers Motherboard is UEFI but has secure boot disabled and I can install any Distro I like with zero trouble as it should be.

 

[Shrimpoodle]

I bought this laptop in May 2024 from Juno Computers. It came preinstalled with Ubuntu 24.04.4 which i still use up until now. Its model is NJ70PU. Its architecture is x86. Its DE is GNOME.

I have no idea how I didn't see this before or maybe I just needed to restart grub again, but apparently I am able to see all my files in grub, including /root, but the only thing inside /root is a few snap files.

I run the Linux kernel and don't have Timeshift.

This paragraph is about what happened with a live USB trying to run Ububtu, Mint, and Finnix, and they all had the exact same result as follows. I disabled secure boot. Booting from the command line gave me the error: you need to load the kernel first (this also happened in the regular partition). Prefix, root, vmlinuz, and initrd were all correct. So i used the linux and initrd conmands and booted from the command line but it stayed stuck there for an hour until I turned off my laptop.

Compatibility mode in Mint in the live usb got me as far as "Measured initrd data into PCR 9" before getting stuck.

I haven't backed up my files in a while. In my situation is it possible to mount an external drive and transfer files onto it?