Migrate from MBR to UEFI with an encrypted system partition

Question

I had the idea of converting a live and running openSUSE installation from MBR to GPT/UEFI. I followed this tutorial and successfully converted disk keeping partitions and associated data. My original setup was the following:

/dev/sda1 ext4 /boot
/dev/sda2 LVM
    /dev/root/root ext4 /
    /dev/root/home ext4 /home

After converting disk to GPT, as I suspected, Linux didn't boot. BIOS didn't show me the option of MBR-booting Linux which now lives on a GPT disk. OK, it's time to setup grub2-efi.

I need to install grub2efi on /dev/sda's EFI partition, which is 156MB large. First, I have converted (read "backed up, formatted and restored files") /boot into VFAT as required by EFI. I also double-checked that the partition type is EFI Boot. I ran a Live openSUSE to mount & chroot into the root partition

# cryptsetup luksOpen /dev/sda2 root
# vgchange -a y suse
# mkdir /mnt/suse
# mount /dev/suse/root /mnt/suse
# mount /dev/suse/home /mnt/suse/home
# mount /dev/sda1 /mnt/suse/boot
# for i in /dev /dev/pts /sys /proc; do mount -B $i /mnt/suse$i; done
# chroot /mnt/suse

I tried with YaST Boot Loader configuration, and later with grub2-efi-install but the result is always the following: when I EFI-boot into Linux I get GRUB's rescue console with error "unknown filesystem".

My current partition setup is the following

/dev/sda1 vfat /boot #only this changed
/dev/sda2 LVM
    /dev/root/root ext4 /
    /dev/root/home ext4 /home

Question straightforward: how do I make grub boot the encrypted system partition?

Answer 1

Found the solution: split /boot in two

1. Backed up all /boot files
2. Removed /dev/sda1 partition (it was 156MB in my case)
3. Created a new smaller /dev/sda1 partition with EFI-boot partition type, formatted with VFAT, mounted to /boot/efi, size 50MB in my case
4. Created a new /dev/sda5 (YaST assigned this number to me, it should be a sda2) partition between the just created /boot/efi and the system partition, mounted as /boot and formatted ext4
5. Restored /boot files from backup
6. Configured grub to resume from sda5 instead of sda2
7. Ran mkinitrd and grub2-efi-install
8. Rebooted

Now I have an almost perfectly working full-UEFI laptop (Windows already booted from UEFI). Almost because grub is missing the theme.

Explanation: why separate partitions?

UEFI and GRUB are very strict: the EFI unencrypted partition is required to load GRUB, the bootloader, into memory.

If I didn't have an encrypted system volume I could easily skip the second part. But the EFI partition only holds the bootloader, which is not the same as the kernel. In order to load the kernel, we need an unencrypted, another unencrypted partition that holds the initrd file which gets loaded by grub.

The concept is simple: grub fires up from EFI partition and immediately seeks for initrd in the /boot partition, which eventually finds that the system volume is encrypted and asks for the key(s)