Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.misc > #16964 > unrolled thread

EUFI and LIVE CD/USB issues

Back to article view | Back to comp.os.linux.misc

Contents

  EUFI and LIVE CD/USB issues T <T@invalid.invalid> - 2016-03-12 21:02 -0800
    Re: UEFI and LIVE CD/USB issues Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2016-03-13 11:28 +0100
    Re: EUFI and LIVE CD/USB issues Arkadiusz Drabczyk <arkadiusz@drabczyk.org> - 2016-03-13 19:37 +0000
      Re: EUFI and LIVE CD/USB issues T <T@invalid.invalid> - 2016-03-13 18:37 -0700
        Re: EUFI and LIVE CD/USB issues Roger Blake <rogblake@iname.invalid> - 2016-03-14 02:51 +0000
          Re: EUFI and LIVE CD/USB issues Arkadiusz Drabczyk <arkadiusz@drabczyk.org> - 2016-03-14 08:09 +0000
            Re: EUFI and LIVE CD/USB issues "Carlos E.R." <robin_listas@invalid.es> - 2016-03-14 10:29 +0100
            Re: EUFI and LIVE CD/USB issues Richard Kettlewell <rjk@greenend.org.uk> - 2016-03-14 10:41 +0000
        Re: EUFI and LIVE CD/USB issues The Natural Philosopher <tnp@invalid.invalid> - 2016-03-14 10:01 +0000
          Re: EUFI and LIVE CD/USB issues dlbendigo  <laidlaws@hotkey.net.au> - 2016-03-15 08:42 +1100

#16964 — EUFI and LIVE CD/USB issues

Hi All,

I can not get my live USB, or CD's for that matter, to boot
with stinkin' EUFI bioses.

Typically, I can go into bios and set it to boot "legacy", but not
on some computers. Some computer so restrict the heck out of what
you can configure that you can not turn on legacy mode.

The last one just had legacy mode grayed out.

How do you guys handle the issue?

Many thanks,
-T

[toc] | [next] | [standalone]

#16967 — Re: UEFI and LIVE CD/USB issues

T a écrit :
> 
> I can not get my live USB, or CD's for that matter, to boot
> with stinkin' EUFI bioses.

UEFI firmwares.
UEFI and BIOS are different kinds of platform firmware.

> Typically, I can go into bios and set it to boot "legacy", but not
> on some computers. Some computer so restrict the heck out of what
> you can configure that you can not turn on legacy mode.

If a UEFI firmware does not support CSM (legacy mode), it is definitely
not a BIOS.

> The last one just had legacy mode grayed out.

Sometimes you must disable the secure boot to enable legacy mode, or
just to be able to boot a UEFI capable system without secure boot support.

Also, be aware that some UEFI platforms have a 64-bit CPU but a 32-bit
firmware, requiring a 32-bit UEFI boot loader. Some 64-bit images only
include a 64-bit UEFI bootloader.

> How do you guys handle the issue?

I use UEFI compatible images.
Maybe you can use a separate UEFI compatible boot loader such as rEFInd
or SuperGRUBdisk, but I haven't used them yet.

[toc] | [prev] | [next] | [standalone]

#16973

On 2016-03-13, T <T@invalid.invalid> wrote:
> Hi All,
>
> I can not get my live USB, or CD's for that matter, to boot
> with stinkin' EUFI bioses.
>
> Typically, I can go into bios and set it to boot "legacy", but not
> on some computers. Some computer so restrict the heck out of what
> you can configure that you can not turn on legacy mode.

What's worse is some machines work differently.  When I was installing
Slackware on EFI machine for the first time I needed to disable legacy
BIOS first (I asked o question on LQ about this:
https://www.linuxquestions.org/questions/slackware-installation-40/setup-eliloconfig-fails-because-of-missing-sys-firmware-efi-4175547821/)

> How do you guys handle the issue?

Last month I successfully installed Slackware on HP-something machine
at work.  I created a customized ISO image with my own configs and
packages with `isohybrid -u'.  It worked well, included ISOLINUX was
able to start Slackware from USB.  Inside installer I make some GPT
partitions and a separate EFI partition. To my surprise I wasn't able
to load Slackware with elilo after installation finished.  I got
"Non-system disk or disk error".  I enabled Legacy BIOS, installed
regular lilo and all worked well.  I don't know why elilo didn't work,
whether it was broken or a particular implementation of EFI on the
machine was buggy.  Secure Boot was of course disabled.

I don't know what would I do if I wasn't able to switch to legacy
mode.

The whole EFI thing is a mess. The only point of it is to prevent
people from installing non-Window OSes.  I even heard that EFI specs
do not explicitly require for user to be able to disable Secure Boot.

-- 
Arkadiusz Drabczyk

[toc] | [prev] | [next] | [standalone]

#16975

On 03/13/2016 12:37 PM, Arkadiusz Drabczyk wrote:
> On 2016-03-13, T <T@invalid.invalid> wrote:
>> Hi All,
>>
>> I can not get my live USB, or CD's for that matter, to boot
>> with stinkin' EUFI bioses.
>>
>> Typically, I can go into bios and set it to boot "legacy", but not
>> on some computers. Some computer so restrict the heck out of what
>> you can configure that you can not turn on legacy mode.
>
> What's worse is some machines work differently.  When I was installing
> Slackware on EFI machine for the first time I needed to disable legacy
> BIOS first (I asked o question on LQ about this:
> https://www.linuxquestions.org/questions/slackware-installation-40/setup-eliloconfig-fails-because-of-missing-sys-firmware-efi-4175547821/)
>
>> How do you guys handle the issue?
>
> Last month I successfully installed Slackware on HP-something machine
> at work.  I created a customized ISO image with my own configs and
> packages with `isohybrid -u'.  It worked well, included ISOLINUX was
> able to start Slackware from USB.  Inside installer I make some GPT
> partitions and a separate EFI partition. To my surprise I wasn't able
> to load Slackware with elilo after installation finished.  I got
> "Non-system disk or disk error".  I enabled Legacy BIOS, installed
> regular lilo and all worked well.  I don't know why elilo didn't work,
> whether it was broken or a particular implementation of EFI on the
> machine was buggy.  Secure Boot was of course disabled.
>
> I don't know what would I do if I wasn't able to switch to legacy
> mode.
>
> The whole EFI thing is a mess. The only point of it is to prevent
> people from installing non-Window OSes.

Why does that ring so true????

> I even heard that EFI specs
> do not explicitly require for user to be able to disable Secure Boot.
>

Sigh.  :'(

Thank you for the insight.

I think I need to look for "secure boot" and disable it.  But,on the 
last HP $400 pieces of ..., I don't believe there was that option.

[toc] | [prev] | [next] | [standalone]

#16976

On 2016-03-14, T <T@invalid.invalid> wrote:
> I think I need to look for "secure boot" and disable it.  But,on the 
> last HP $400 pieces of ..., I don't believe there was that option.

Unless it's changed that was supposed to be a required part of the secure
boot spec for x86.

-- 
-----------------------------------------------------------------------------
  Roger Blake (Posts from Google Groups killfiled due to excess spam.)

  NSA sedition and treason -- http://www.DeathToNSAthugs.com
-----------------------------------------------------------------------------

[toc] | [prev] | [next] | [standalone]

#16977

On 2016-03-14, Roger Blake <rogblake@iname.invalid> wrote:
> On 2016-03-14, T <T@invalid.invalid> wrote:
>> I think I need to look for "secure boot" and disable it.  But,on the 
>> last HP $400 pieces of ..., I don't believe there was that option.
>
> Unless it's changed that was supposed to be a required part of the secure
> boot spec for x86.
>

I am not sure if this was clarified in the spec but apparently MS has
their own view on that matter.  As this
https://en.wikipedia.org/wiki/Windows_10 wikipedia article says:

"Unlike Windows 8, OEMs are no longer required to make Secure Boot
settings user-configurable, meaning that devices may optionally be
locked to run only Microsoft-signed operating systems."

They cite this article:
http://arstechnica.com/information-technology/2015/03/windows-10-to-make-the-secure-boot-alt-os-lock-out-a-reality/

IIUC correctly, that means that if you got "Windows 10 Certified blah
blah" machine you may not be able to install Linux on it unless you
replace firmware which may be hard or impossible in practice.

Luckily I have never touched Windows 10 machine but if this is what OP
has he may not be able to disable Secure Boot.

And when it comes to ARM Windows-RT family they explicitly say that
Secure Boot *cannot* be disabled:

"For logo-certified Windows RT 8.1 and Windows RT PCs, Secure Boot is
required to be configured so that it cannot be disabled."

(from
https://msdn.microsoft.com/en-us/library/windows/hardware/dn898540(v=vs.85).aspx)

-- 
Arkadiusz Drabczyk

[toc] | [prev] | [next] | [standalone]

#16978

On 2016-03-14 09:09, Arkadiusz Drabczyk wrote:
> On 2016-03-14, Roger Blake <rogblake@iname.invalid> wrote:


> IIUC correctly, that means that if you got "Windows 10 Certified blah
> blah" machine you may not be able to install Linux on it unless you
> replace firmware which may be hard or impossible in practice.

No. You simply need Linux install media and boot procedures that are
signed properly.

The signatures or certificates, as far as I know, are kept by Microsoft,
yes, but not owned by them, and they are either free or very cheap. And
it is Microsoft because that's the certificate authority all
manufacturers install, but there could be others. In fact, you should be
able to create your own certificate and install it into your computer
firmware; if you can't, it is a broken implementation of UEFI. Which is
the real problem: broken or restricted implementations.

https://wiki.ubuntu.com/SecurityTeam/SecureBoot

https://en.opensuse.org/openSUSE:UEFI

http://fsfe.org/campaigns/generalpurposecomputing/secure-boot-analysis.en.html

-- 
Cheers, Carlos.

--- news://freenews.netfront.net/ - complaints: news@netfront.net ---

[toc] | [prev] | [next] | [standalone]

#16980

Arkadiusz Drabczyk <arkadiusz@drabczyk.org> writes:
> On 2016-03-14, Roger Blake <rogblake@iname.invalid> wrote:
>> On 2016-03-14, T <T@invalid.invalid> wrote:
>>> I think I need to look for "secure boot" and disable it.  But,on the
>>> last HP $400 pieces of ..., I don't believe there was that option.
>>
>> Unless it's changed that was supposed to be a required part of the secure
>> boot spec for x86.

It still is.

> I am not sure if this was clarified in the spec but apparently MS has
> their own view on that matter.  As this
> https://en.wikipedia.org/wiki/Windows_10 wikipedia article says:
>
> "Unlike Windows 8, OEMs are no longer required to make Secure Boot
> settings user-configurable, meaning that devices may optionally be
> locked to run only Microsoft-signed operating systems."
>
> They cite this article:
> http://arstechnica.com/information-technology/2015/03/windows-10-to-make-the-secure-boot-alt-os-lock-out-a-reality/

That’s a presentation, not a specification, though for some reason it’s
popular to cite it instead of the actual specification, which requires,
among other things:

| On non-ARM systems, the platform MUST implement the ability for a
| physically present user to select between two Secure Boot modes in
| firmware setup: “Custom” and “Standard”. Custom Mode allows for more
| flexibility as specified in the following:
|
| * It shall be possible for a physically present user to use the Custom
|   Mode firmware setup option to modify the contents of the Secure Boot
|   signature databases and the PK. This may be implemented by simply
|   providing the option to clear all Secure Boot databases (PK, KEK,
|   db, dbx), which puts the system into setup mode.
|
| * If the user ends up deleting the PK then, upon exiting the Custom
|   Mode firmware setup, the system is operating in Setup Mode with
|   SecureBoot turned off.
|
| * The firmware setup shall indicate if Secure Boot is turned on, and
|   if it is operated in Standard or Custom Mode. The firmware setup
|   must provide an option to return from Custom to Standard Mode which
|   restores the factory defaults. On an ARM system, it is forbidden to
|   enable Custom Mode. Only Standard Mode may be enabled.

I don’t know UEFI secure boot well, but my understanding is that PK is
the trust anchor, making the ability to change or remove it sufficient
to boot anything you like.

-- 
http://www.greenend.org.uk/rjk/

[toc] | [prev] | [next] | [standalone]

#16979

On 14/03/16 01:37, T wrote:
> On 03/13/2016 12:37 PM, Arkadiusz Drabczyk wrote:
>> On 2016-03-13, T <T@invalid.invalid> wrote:
>>> Hi All,
>>>
>>> I can not get my live USB, or CD's for that matter, to boot
>>> with stinkin' EUFI bioses.
>>>
>>> Typically, I can go into bios and set it to boot "legacy", but not
>>> on some computers. Some computer so restrict the heck out of what
>>> you can configure that you can not turn on legacy mode.
>>
>> What's worse is some machines work differently.  When I was installing
>> Slackware on EFI machine for the first time I needed to disable legacy
>> BIOS first (I asked o question on LQ about this:
>> https://www.linuxquestions.org/questions/slackware-installation-40/setup-eliloconfig-fails-because-of-missing-sys-firmware-efi-4175547821/)
>>
>>
>>> How do you guys handle the issue?
>>
>> Last month I successfully installed Slackware on HP-something machine
>> at work.  I created a customized ISO image with my own configs and
>> packages with `isohybrid -u'.  It worked well, included ISOLINUX was
>> able to start Slackware from USB.  Inside installer I make some GPT
>> partitions and a separate EFI partition. To my surprise I wasn't able
>> to load Slackware with elilo after installation finished.  I got
>> "Non-system disk or disk error".  I enabled Legacy BIOS, installed
>> regular lilo and all worked well.  I don't know why elilo didn't work,
>> whether it was broken or a particular implementation of EFI on the
>> machine was buggy.  Secure Boot was of course disabled.
>>
>> I don't know what would I do if I wasn't able to switch to legacy
>> mode.
>>
>> The whole EFI thing is a mess. The only point of it is to prevent
>> people from installing non-Window OSes.
>
> Why does that ring so true????
>
>> I even heard that EFI specs
>> do not explicitly require for user to be able to disable Secure Boot.
>>
>
> Sigh.  :'(
>
> Thank you for the insight.
>
> I think I need to look for "secure boot" and disable it.  But,on the
> last HP $400 pieces of ..., I don't believe there was that option.

I cant remember how I did it, but on my tosh lappytop, it was remarkably 
easy to get UEFI boot going.

Latests Mint seemed to pretty much understand it, and there was just one 
hack I had top do IIRC to get dual boot going.

Not that I have used it.

Who wants windows 10?


-- 
New Socialism consists essentially in being seen to have your heart in 
the right place whilst your head is in the clouds and your hand is in 
someone else's pocket.

[toc] | [prev] | [next] | [standalone]

#16982

The Natural Philosopher <tnp@invalid.invalid> Wrote in message:
> Who wants windows 10?
> 
Indeed!  I have a program that was buggy under Windows 10.  I have
 just run 
Windows' compatibility checker, which told me to pretend it was
 Windows 7.

But UEFI
has been on the Mac for a while.  I have a new GeForce
 motherboard.  
With it, I can press F12 for a boot menu, and choose which device
 to boot from,
and whether to use UEFI or BIOS settings.

UEFI isn't there to prevent people from installing non-Windows. 
 It is there
to prevent people from ditching Windows.  Even the tech writers
 say that
Win 10 is Microsoft's last chance to get some users back.  As everybody
(except me) turns to the Mac, sales of PCs are dropping.

Doug.
-- 

[toc] | [prev] | [standalone]

Back to top | Article view | comp.os.linux.misc

csiph-web