[SOLVED] Booting install CD when uefi and secure boot are enabled

[oldfred]

Have you turned both secure boot & fast boot off?
You will need to use the 64 bit version of 12.10 and from the UEFI menu boot the flash drive in UEFI mode. That way it will install in UEFI mode.
Systems need quick boot or fast boot turned off in UEFI settings. Vital for some systems. Best to backup efi partition and Windows partition first.
Use Windows Disk Tools to shrink Windows main partition, but not to create any new partitions, if installing on same drive.
https://help.ubuntu.com/community/UEFI
https://wiki.archlinux.org/index.php/UEFI
As of 12.04.2, it is possible to install on UEFI systems with Secure Boot enabled (using signed versions of Shim, GRUB, and the Linux kernel). This is only currently set up for Ubuntu (desktop, alternate, and server) and Edubuntu images due to pressures of time; we expect to enable it across the entire Ubuntu family for 12.04.3. Details:
https://wiki.ubuntu.com/PrecisePango.../UbuntuDesktop


You need Boot-Repair or manually update grub's efi entries as per bug report.
grub2's os-prober creates wrong style (BIOS) chain boot entry
https://bugs.launchpad.net/ubuntu/+s...2/+bug/1024383
type of entry from Boot-Repair that should work.
'Windows UEFI loader'
Type of entry that does not work:
'Windows ...) (on /dev/sdXY)'

[squakie]

I had Ubuntu 64-bit 12.10 working with UEFI secure boot both on, just no grub menu - the bug explains that - thanks!

However, after running boot-repair selecting Windows on the grub menu resulted in an error line about image not found. I then just gave up and removed Ubuntu - the grub menu was still there for some reason but nothing would boot. So, I restored from my Factory reset disks, but grub was still there. So I did the factory reset again and told it to run from the DVD and do a complete wipe and install. That worked and I'm in the process of putting things back now.

So, to summarize:

• UEFI and secure boot both enabled
• Ubuntu installed and the partition showed as UEFI in the BIOS boot selection and I could boot from that menu to grub
• the Windows partitions showed as UEFI in the BIOS boot selection and I could boot from that menu to Windows (I'm hoping I remember this correctly - I tried a lot of stuff in a short period of time).
• no grub menu (explained by the bug you pointed me to)
• booted straight in to Ubuntu
• I downloaded and installed boot-repair within Ubuntu itself
• with UEFI and secure boot *on* I ran boot-repair then rebooted
• When I just left the PC boot on its own I got the grub menu
• I could boot Ubuntu
• I couldn't boot Windows - image not found error messages

So, my desktop is sold and right now I'm without Ubuntu, which I hate not having. I'm going to do a lot more reading again and again until I think there is a method that won't leave me with the same problems as I don't want to go through a reload of Windows 8 again. The mess I had last night was worse than when I was a complete newbie trying to figure out how to get Slackware installed back in 1994.

Thanks for those tips - I' going to read through all of that again and again, and re-read everything I read on the net, and when I'm regrouped and confident enough it will work "this time", I will repartition and try installing Ubuntu for dual-boot again, following the information you provided for both the grub bug and using boot-repair.

When I did try stand-alone boot repair it would show on the BIOS boot menu, even with secure boot off. I did not at that time turn of UEFI however (there must be more going on there than what I read). I did install it within Ubuntu with UEFI on and secure boot off, then re-enabled secure boot and that's when I got the first set of errors - the BIOS wouldn't boot either OS because of a security error, I assumed from secure boot. So I re-enable secure boot (so I had both uefi and secure boot enabled) then booted into Ubuntu and re-ran boot repair. That's what generated the mess I got in to.

I'm not sure how I could run boot-repair with UEFI and secure boot both disabled. I know that with both disabled I would then be able to boot the boot-repair disk itself, but won't it still generate the same BIOS boot security problem when I try to boot with UEFI and secure boot on again?

BTW - thanks again for the help!

[oldfred]

Supposedly if Ubuntu is installed in UEFI mode it should boot with secure boot on. It actually uses the the same UEFI key as Windows so it is authorized.

But we are finding that vendors modify UEFI to only boot Windows. For many of those cases Boot-Repair renames the Windows file to a backup and copies in the shim efi file which has the Microsoft key and those systems boot Ubuntu. Then from grub menu you can boot the renamed Windows file. Boot-Repair renames or unrenames on multiple runs.

How Boot-Repair fixes a Ubuntu with grub-pc with efi Windows
http://ubuntuforums.org/showpost.php...&postcount=516
Boot-Repair - Updated Jan 1, 2013 to not rename first time, but rename if first time Windows does not boot. Post 706 and 711
http://ubuntuforums.org/showthread.p...769482&page=71
Boot-Repair copied /EFI/ubuntu/grubx64.efi to /EFI/Boot/bootx64.efi (in case the BIOS is hard-coded to boot into /EFI/Boot/bootx64.efi or secure boot
signed GRUB file shimx64.efi.


But even then some systems just do not work.
Some Toshiba's will not boot.
they managed to leave the signing key out of the database that's used to validate binaries
Lenovo ThinkCentre M92p only boots Windows or Redhat.
http://www.phoronix.com/scan.php?pag...tem&px=MTIyOTg
http://mjg59.dreamwidth.org/20187.html?thread=774619

The current state of UEFI and Linux = Feb 1, 2013 - Matthew Garrett
Samsung, Lenovo & Toshiba UEFI issues
http://mjg59.dreamwidth.org/22028.html
Matthew Garrett's Blog
http://mjg59.dreamwidth.org/
New Linux UEFI boot loader
http://mjg59.dreamwidth.org/23113.html

Some have posted that Both Ubuntu & Windows boot with secure boot on or off. Some seem to be able to boot with secure boot off. And some have major issues.

Dell's seem to be one of the better ones for using UEFI.
Installing Ubuntu 12.10 x64 on Dell XPS 13 Alongside Windows from USB New user with Details
http://ubuntuforums.org/showthread.php?t=2108450
Dell XPS14
http://ubuntuforums.org/showthread.php?t=2116597
HOWTO Ubuntu 12.10 x64 Dell XPS 14 (UEFI + Intel Rapid Start Technology + Flashcache) - Details
http://ubuntuforums.org/showthread.php?t=2117166
Dell XPS13 general info mega-thread
http://ubuntuforums.org/showthread.php?t=1932965

[squakie]

Thanks! I see I have a lot more reading to do It appears that UEFI goes far beyond what I read on the web as my understanding was that it and secure boot were separate animals, but it appears they are somehow intertwined. More reading!

The laptop is a new Dell Inspiron 15R with 8 gb memory, 1tb hard drive, Intel i5, if that makes any difference to how things should go. The wireless and the graphics seemed fine when I did boot Ubuntu.

Thanks again!

[oldfred]

UEFI has been around for a while. Many Windows 7 systems with Intel i-series chips have UEFI, but were all using the BIOS/CSM/legacy mode. Only a few used UEFI and those did not have secure boot. or secure boot enabled.

Since Windows only boots withUEFI with gpt partitioning or with BIOS from MBR(msdos) partitioning it is difficult to convert from BIOS to UEFI or vice-versa.

Ubuntu will boot from gpt partitioned drives with either BIOS or UEFI, but UEFI requires gpt for all systems.

Since BIOS or UEFI write details of system differently onto drive for operating system to use, you really need to boot both Windows and Ubuntu in the some mode either BIOS or UEFI.
You can dual boot when not same mode, but have to go back into BIOS/UEFI and change boot mode to correct mode for the install or a real hassle.

[squakie]

Thanks again! For now, I guess it's just not to be for me. My new laptop is dual core i5, but running Ubuntu in VirtualBox on it is a disaster - at least to me. It is unbelievably slow - I mean REALLY slow. I have an old Dell 1501 laptop I use for controlling me telescope (or maybe I should say, I'm TRYING to use it to control my telescope - so far that's been hit and miss, and I suspect I will need to spend quite some time testing it indoors before I go outside with it). That's single core Sempron, and even with 1 core Ubuntu in a VirtualBox VM on it (Windows XP host) runs a lot faster.

I guess the new laptop is working fine - it seems to be. It's just unfortunate that for the time being I can't run Ubuntu on it. My desktop has been sold, so I've lost the ability to dual boot unless I install it on the 1501 for the telescope, but then I'd be defeating the purpose of the new laptop.

I suspect there are still many wrinkles to work out with UEFI - vendor, Ubuntu and all, not just one. I may have to wait until those things get worked out before I can run Ubuntu again, and that's a disappointment for me.

Almost makes me wish I hadn't sold the desktop, but it was just overkill for me. At the time I built it I used some good stuff: AMD FX-8120 8-core CPU, 16gb memory, M5A97 motherboard, 1.5 tb hard disk, 60gb SSD, DVD-RW/DL, etc., and a Samsung 23.6" viewable area monitor. Just turns out the monitor was actually TOO big for my diabetic eyes. Power wise, I wasn't hardly touching it even with some of my most demanding tasks. So it just seemed like a good idea to get a laptop to replace it and sell the desktop. The laptop is fine for me - I just wish everything would cooperate so that Windows 8, Ubuntu, UEFI and secure boot would all work together.

Again, thanks for the help. I'm just going to mark the thread solved for now. Hopefully down the road something will improve and I can go back to using Ubuntu again.

[oldfred]

Are you using the Intel graphics?

Some reported with newer systems this helps.
For Intel graphics running slow:
sudo apt-get install mesa-utils
glxinfo | grep OpenGL | head -n3


There may be other fixes also, I have not stayed up to date on Video issues other than my nVidia.

[squakie]

Yep - it's using Intel HD Graphics 4000 or some such - an integrated GPU.

[squakie]

OK, I reopened this as I'm at a point where perhaps it's either clear what's wrong or perhaps gives more hints(?).


Here's what I've done:

• downloaded and burned the 64-bit version of the 12.10 desktop install ISO
• in Windows 8, used disk management to optimize the disk
• in Windows 8, shrank the Windows 8 main partition (I've got like 5 or 6 partitions out there that the Windows 8 install created) by 70gb
• boot by selecting the UEFI Ubuntu on the DVD drive via the BIOS boot menu (via F12 when the hardware is booting)
• installed Ubuntu to the free space with a logical partition for "/", swap and "/home"
• tried booting - got the grub menu, but only Ubuntu would boot. I expected this based on the bug.
• booted the livecd and selected "Try Ubuntu"
• installed boot-repair
• ran boot repair and took the default recommended action
• tried booting - this time with the same results. This time trying to boot Windows just gave a bunch of security errors having something to do with the /EFI/Ubuntu/shimx64.efi file because of secure boot.
• disabled secure boot in the BIOS (I don't see anything for fast boot)
• booted the livecd and selected "Try Ubuntu"
• installed boot-repair
• ran boot repair, selecting Windows 8 as the operating system to boot first and continuing with the default
• booted the livecd and selected "Try Ubuntu" again
• downloaded and installed boot-repair again
• rebooted - the laptop went straight into Windows 8 (so I can at least boot it again)
• rebooted, but used the BIOS boot menu to select uefi Ubuntu (there are 2 entries for it in the boot menu - both give the same result)
• this brought up the grub menu
• selected Windows, got: error: can not find command "drive" followed by "error: invalid EFI file path" followed by a message to press any key (or it times out and does the same anyway) to go back to the grub menu. Ubuntu still works fine.

So, I really would prefer to run with secure boot on (when I did the actual install UEFI and secure boot where both enabled - without that, if I turn secure boot back on the system won't even get to the grub menu). Right now I think it has something to do with the EFI file that Ubuntu creates.


When I ran boot-repair, there were 2 things that I can post here if it helps:

• the location for the boot info script output is http://paste.ubuntu.com/1703660
• the message "Please do not forget to make your BIOS boot on sda1/EFI/Ubuntu/shimx64.efi file"

I do not see an option in the BIOS boot disk (in the actual BIOS setup) for that option, so I just rebooted using the BIOS boot selection menu to select either of the UEFI Ubuntu options.

I turned secure boot back on now. At least it will boot to Windows 8 by default now. If I want Ubuntu I have to actually go to the BIOS boot selection menu and select 1 of the 2 UEFI options.

With all that in mind, it seems to me it must be something with the EFI file that Ubuntu is creating, and how the grub entries are either created or where they point to when boot-repair is used.

Any suggestions would be greatly appreciated. Things are "usable" but not easily like it would be with grub. I'm not going to try anything else on my own now as I don't want to make things worse. So, I am "desperately" waiting for suggestions on how to get this straighten out - at which point I will try the suggestions.

I really have read all kinds of the things you've pointed to and a lot of other posts on the net itself, and I thought it best to just leave things as-is until I hear more.

Thanks again!

EDIT: forgot to mention that in the boot-info output there are warnings about a gui partition table (GPT) (?) being found on /dev/sda and to use gnu parted instead of fdisk. Is this something I would have need to set somehow (I don't have a clue where) when I installed Ubuntu?

[squakie]

As soon as this dumb external USB disk (Toshiba 750gb a couple of years old) gets done with a full format (the dang thing has been running for literally HOURS already and still not done!), I'm going to try the thing mentioned in the how-to:

- rerun boot-repair, double checking the option for the EFI table.
- if I don't have the separate Ubuntu EFI partition it says I need to create it

I don't know what any of that is going to do, but I'll try it. I've read more on UEFI and secure boot, and what a mess.