Qubes 4.1 Not booting after bios update please help

These errors most probably mean that your Qubes LUKS partition wasn’t decrypted for some reason.
Are you ending up with dracut-initqueue timeout here?
Can you copy log from there and check it for errors or upload it here?

last night i was trying to install windows 10 on my 240GB ssd but it created partition on nvme0n1.
My qubes luks partition couldn’t be decrypted for this reason.
Linux and Windows don’t go well together.

I can find EFI and windows recovery partition on my nvme. so i guess nothing can be done at this stage?

You tried to install Windows on SSD that has Qubes with detached header?
Or you tried to install Windows on another SSD but Windows ended up creating partitions on your Qubes SSD?
Since all your Qubes SSD was encrypted and you had detached header then WIndows just treated all your disk as free space.
You can try to manually decrypt your nvme0n1 but I’m not sure if it’s possible to recover LVM when it was partially overwritten, assuming /dev/nvme0n1 - your Qubes disk and /dev/sde1 - detached header:

sudo cryptsetup luksOpen /dev/nvme0n1 qubes_dom0 --header=/dev/sde1
sudo vgchange -ay

Or you tried to install Windows on another SSD but Windows ended up creating partitions on your Qubes SSD? YES fuck windows!

what happen if you try to open this on qubes os rescue ?

Enter passphrase for /dev/nvme0n1:
vgchange -an
0 logic volumes(s) in volume group “qubes_dom0” now active

Timed out waiting for device /dev/sde3 sometimes.

Do you have dom0 root volume among them?

Is it EFI partition or what?
And where do you get this timeout? In dracut during Qubes boot?

No. The sde1 is EFI, sde2 encrypted boot, sde3=header

Warning: USB in dom0 is not restricted. Consider rd.qubes_all_usb or usbcore.authorized_default =0

/dev/mapper/qubes_dom0/root does not exist
/dev/qubes_dom0/swap does not exist
Generating logs…

Dracut timeout error. emergency shell


kernel command line: placeholder root=/dev/mapper/qubes_dom0-root ro rod.luks.uuid=luks-uuidB rd.lvm.lv=qubes_dom0/root…
/usr/bin/setfond failed with exit status 71
dev-sde.device: job dev-sde3.device/start timed out
timed out waiting for device /dev/sde3
dependecy failed for cryptography setup of luks uuidR

Can you enter terminal here:
And check if your USB drive with detached header is present?
Maybe it just has a different letter like /dev/sdd instead of /dev/sde?
Also I’ve just skimmed his guide:
Qubes OS Installation - Detached encrypted boot and header
But I think this:

echo "luks-$uuidR /dev/nvme0n1 /etc/keys/root.key luks,discard,key-slot=1,header=/dev/sda3
luks-$uuidB UUID=$uuidB /etc/keys/boot.key luks,key-slot=1" > $initdir/etc/crypttab

Should be changed from specifying drives by non-static name like /dev/sda to specifying drives by UUID like /dev/disk/by-partuuid/12345678-1234-….
And this one as well:

echo "/dev/nvme0n1 $uuidR
/dev/disk/by-uuid/$uuidB $uuidB" > "{initdir}/etc/block_uuid.map"

Can you enter terminal here:


And check if your USB drive with detached header is present? Yes, it’s present i did dd=/header.

Maybe it just has a different letter like /dev/sdd instead of /dev/sde?
yes it changes now it’s sde

echo "/dev/nvme0n1 $uuidR
/dev/disk/by-uuid/$uuidB $uuidB" > "{initdir}/etc/block_uuid.map"

Yes. I have made the required changes.

It boots sometimes but sometimes darcut error.
and lastly How can take backup of header and boot? The qubes manager backup and store work the same way for detached boot and header?

Not sure what do you mean about dd.

I’m not asking if you’ve changed your drive from /dev/sda to /dev/sde according to the guide.
I’m talking about a need to change /dev/sde3 to /dev/disk/by-uuid/< UUID > where < UUID > is output of blkid -o value -s UUID /dev/sde3 in /etc/crypttab in initramfs so that you won’t have this issue anymore:

Just save the partition image with dd:

# Backup your USB drive partition table
sudo sfdisk -d /dev/sde > /path/to/store/backup/usb-parttable.dump
# Backup partitions
sudo dd if=/dev/sde1 of=/path/to/store/backup/efi.img
sudo dd if=/dev/sde2 of=/path/to/store/backup/boot.img
sudo dd if=/dev/sde3 of=/path/to/store/backup/header.img

# Restore your USB drive partition table on new USB
sudo sfdisk /dev/sde < /path/to/store/backup/usb-parttable.dump
# Restore partitions
sudo dd if=/path/to/store/backup/efi.img of=/dev/sde1
sudo dd if=/path/to/store/backup/boot.img of=/dev/sde2
sudo dd if=/path/to/store/backup/header.img of=/dev/sde3

Booted into qubes rescue, skip to shell
`cryptsetup luksOpen /dev/nvme0n1 qubes_dom0 --header=/dev/sde3
vgchange -an
cat /etc/fstab

I had changed the uuidR & uuidB values while installing and it went smooth but now unable to decrypt after entering boot password system login screen not coming.

Boot into qubes rescue, skip to shell and run:

# Decrypt Qubes disk
cryptsetup luksOpen /dev/nvme0n1 qubes_dom0 --header=/dev/sde3
# Activate decrypted LVM
vgchange -ay
# Check to see if your LVM volumes are there
# or
ls /dev/mapper
# If your LVM volumes are present adn there is dom0 root among them then mount Qubes dom0 root
mkdir /mount
mount /dev/mapper/qubes_dom0-root /mount
# Check if dom0 root ls mounted and works
cat /mount/etc/fstab

Yes cat /mount/etc/fstab is showing the entries.

I have properly setup the configuration to boot.

/dev/mapper/qubes_dom0-root / ext4 defaults,x-systemd.device-timeout=0,discard 1 1
/dev/mapper/luks-mybootuuid /boot ext2 defaults 1 2
UUID=b453-254d /boot/efi vfat umask…
/dev/mapper/qubes_dom0-swap none swap defaults…

Then your dom0 root should be ok (at least partly).
Can you describe what exact problem do you have right now? I’ve lost the thread of the conversation a bit.

It doesn’t load the login screen after entering the password. It takes very long time and sometimes it doesn’t load at all. I get the following error.

/dev/mapper/qubes_dom0/root does not exist
/dev/qubes_dom0/swap does not exist

When i check logs i can see that /dev/sde3 timeout error.

So sometimes you’ll boot to your login screen but it’ll take a long time to boot and sometimes it won’t boot to login screen and you’re getting the dracut-initqueue timeout and end up here:
Where you can see /dev/sde3 timeout error in rdsosreport log?
And when you check if /dev/sde3 is present in dracut shell it’ll be there?

Yes. Sometimes it will boot to login screen quick sometimes not it takes too much time and gets stuck.
After some time i get dracut error and if i check in rdsosreport i see that /dev/sde3 timeout.

Check at this time if /dev/sde is present in your system or not, run:

# or
fdisk -l

And check if maybe your USB disk is present but it has a different name like /dev/sdd or something.

If your USB drive will be present but it’ll just have different name then you can fix it like this:
Boot in Qubes.
Run these commands in dom0 terminal:

# Backup initramfs files just in case something is wrong so you can restore them later or delete them if all is good
mkdir ~/initramfs-bak
sudo cp -r /boot/initramfs-* ~/initramfs-bak/.
# Change initramfs so dracut will search for USB drive by UUID instead of random name like /dev/sde
sudo sed -i "s|/dev/sde3|/dev/disk/by-uuid/$(blkid -o value -s UUID /dev/sde3)|g" /etc/crypttab
dracut -v -f /boot/initramfs-*