[Bug 1201257] Re: Secure Boot doesn't work with ASUS S56CB

[Steve Langasek]

> So, is the problem in the installer?

Yes, it's a problem in the 13.04 installer that installing with Secure
Boot disabled will not install the packages needed to keep Ubuntu
booting if Secure Boot is turned on.  This bug has been fixed for 13.10
(and 12.04.3).

> As I said the same problem exists with Saucy when I try to boot with Secure Boot
> enabled, but there is more: after disabling Secure Boot, again I couldn't boot to
> Ubuntu! If I boot with Secure Boot, it hangs just after selecting "Try Ubuntu" but
> with Secure Boot disabled, after selecting "Try Ubuntu" I saw the Ubuntu screen
> with 5 dots and then it hanged in black screen. As it's in the beta stage, maybe it's
> too early to judge, but seems like there are other problems with 13.10 too.)

If you see the "Try Ubuntu" option, then you've successfully loaded both
shim and grub; and if you get the five dots, you've made it to the
kernel and initramfs.  So that's a separate issue from the original
SecureBoot question.  If you can reproduce it with the current 13.10
images please file a separate bug report for it.  Best to file the bug
report against the 'ubiquity' package initially.

Rereading the original problem in light of current information, the
problem all comes down to the issue I mention above, that before 13.10
the installer would not install shim if the system was not booted under
Secure Boot.  If you had installed with Secure Boot enabled, shim would
have been set up as bootx64.efi; and because shim is signed by the
Microsoft key, it would be bootable both from the Microsoft bootloader
and from UEFI.  However, since shim was *not* installed, you were trying
to boot grub directly from the Microsoft bootloader.  The Microsoft
bootloader is known to enforce Microsoft key signatures, even if Secure
Boot is disabled in firmware and *even if other keys are registered in
the firmware*.  So this will never work without shim.  It is also not
how the Ubuntu installer sets up the bootloader: the Ubuntu installer
will correctly register its own boot entry with the firmware using
efibootmgr.  You would not have hit this problem if you had not second-
guessed the installer.  Anyway, with the latest version of the installer
we avoid this problem.

It sounds like there may still be some problems booting Ubuntu on your
system, particularly booting the installer.  But those problems are
unrelated to the Secure Boot support itself, and should be tracked in a
separate bug.  So I'm going to mark this bug as resolved.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to shim in Ubuntu.
https://bugs.launchpad.net/bugs/1201257

Title:
  Secure Boot doesn't work with ASUS S56CB

Status in “shim” package in Ubuntu:
  Incomplete

Bug description:
  Here are the information and the exact steps I followed:

  - My laptop is ASUS S56CB with Windows 8 pre-installed.
  - Prepared partitions using Windows' own disk management utility.
  - I prepared a Ubuntu 13.04 (64 bit) ISO to boot with a USB.
  - Disabled Fast Boot. When I tried to install Ubuntu in UEFI mode, Secure Boot didn't allow, then I also disabled Secure Boot.
  - Everything went fine and installation started. I continued in the normal way till the partition point.
  - I created an EFI partition, "swap", "root" and "home" partitions and set the bootloader to be installed on the EFI partition. I don't want to use Ubuntu's GRUB loader, so I didn't install GRUB on dev/sda, but on dev/sda5 as the Ubuntu EFI partition was there.
  - Installation finished, and I opened Windows 8. Using EasyBCD, I created a new boot entry and rebooted to see if it would load Ubuntu.
  - When I choose Ubuntu entry, I get this error:

  File :\NST\AutoNeoGrub0.mbr
  Status: 0xc000007b

  If I try starting Ubuntu from UEFI (by pressing Esc while the computer
  boots), I'm able to boot into Ubuntu. However, as I stated it doesn't
  work in Windows 8's boot menu.

  The problem related to Windows 8's boot menu not starting is another
  issue, but the real problem is that Ubuntu cannot be installed in this
  computer without disabling Secure Boot.

  Regards,
  Şâkir Aşçı

  ProblemType: Bug
  DistroRelease: Ubuntu 13.04
  Package: shim (not installed)
  ProcVersionSignature: Ubuntu 3.8.0-19.29-generic 3.8.8
  Uname: Linux 3.8.0-19-generic x86_64
  ApportVersion: 2.9.2-0ubuntu8
  Architecture: amd64
  Date: Mon Jul 15 06:37:37 2013
  InstallationDate: Installed on 2013-07-15 (0 days ago)
  InstallationMedia: Ubuntu 13.04 "Raring Ringtail" - Release amd64 (20130424)
  MarkForUpload: True
  ProcEnviron:
   TERM=xterm
   PATH=(custom, no user)
   XDG_RUNTIME_DIR=<set>
   LANG=tr_TR.UTF-8
   SHELL=/bin/bash
  SourcePackage: shim
  UpgradeStatus: No upgrade log present (probably fresh install)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/shim/+bug/1201257/+subscriptions