UEFI Frustration
 

I am sure you are all aware of the secure UEFI limitations, but I wanted to vent a bit.

I was playing with my new laptop and I thought it would be fun to experiment with a UEFI installation.

When I set up my Arch Linux USB for UEFI and rebooted, I received:

When I reset the motherboard for a legacy bios using the normal procedure it works fine.

I guess I am SOL with UEFI. It's not a big deal because I didn't want my Windows 8 partition. I am a little frustrated with the secure UEFI locking down my PC that paid for. PCs seem to be going like Apple.

Oh well, I paid the Windows tax. At least they still allow for legacy boot options.

The legacy bios seems to boot faster than UEFI, I just thought it would be nice to experiment with my laptops new firmware.

Linux Foundation to offer signed solution for UEFI Secure Boot conundrum
I guess I'll wait to this trickles down to the major distros...

Or use Fedora...
Linus Torvalds on Windows 8, UEFI, and Fedora

Hopefully, PCs continue to get legacy bios options in the mean time.

And again it goes. You are not restricted by the UEFI firmware, but by the Secure Boot function. This is why it works in leagcy BIOS mode (which doesn't support Secure Boot). Just disable Secure Boot in the firmware setup. If you have a laptop with Windows 8 logo somewhere on it there must be such an option, if there isn't such a logo it depends on your lack if that option exists.

I see that you have been explaining this over and over. It must be a redundant practice by now for you-
I tip my hat to you TobiSGD; your good at what you do!

Have a good week!

Unfortunately, Acer does not allow the secure boot to be disabled. The option is greyed out and unselectable.

What is the exact model name of that machine?

Thank you for your help.

I contacted Acer about the issue. They recommended that I upgrade my BIOS. Unfortunately, the BIOS flash only supports Windows 8.

I made a FreeDOS image with a new and older version of the BIOS.

I am currently at version BIOS 2.02 My computer upgrades can be found here:http://support.acer.com/us/en/produc...1&modelId=4244

The newer version 2.06 (Windows 8) says it will not run in DOS mode.

The older version 1.07 says that it is less than the current version and is protected.

I have played with the flags and attempted to disable the version comparison and disable model comparison but I am still having no luck.

Does Acer have some kind of a lock or encryption on the bootloader/MBR?
Just trying to understand-
What make and model is it?

Product Family: Notebook
Product Line: Aspire
Product Model: Aspire V3-551

The customer rep assured me once my BIOS is updated that the option to disable secure boot will become available. The version that shipped had secure boot locked on.

Ahh...I see; have you been successful at updating the BIOS?
Did the representative or tech walk you through it?

TobiSDG is correct. I need to disable secure boot. The customer representative identified that the current BIOS has secure boot locked and I need to update my BIOS. Since the problem has changed I have created a new thread at http://www.linuxquestions.org/questi...31#post4848831

I don't think he could walk me through it as I do not have Windows 8 on my machine. I suppose I could see if they could send me an OEM version of Windows 8 to me.

I have not been successful.

Update: I manage to flash the BIOS without Windows 8 see my post here.

So the Acer tech lied (surprise surprise). I am currently running the latest BIOS and secure boot is mandatory (no option to disable) if running UEFI.

hi

If we want to install linux we must disable secure boot first, right? And once this is done, the bios will let us install any distro and we don't have to worry about signed keys. Is my assumption correct?

Yes you are correct, unfortunately Acer has locked "secure boot" to enabled on my laptop (Acer V3-551).

It's too bad we can't tell what companies have secure boot locked to enabled without buying it. It is a conspiracy against linux and other alternative operating systems. I will keep in mind of staying away from Acer. BTW, if anyone has secure boot locked to enable, please provide make and model so we don't get screwed.

thanks

You can. Any x86 machine that has a Windows 8 Logo certification must have the option to disable Secure Boot and to manage your own keys.

Does this apply to amd64 machines? My Acer definitely has the Windows 8 Logo certification.

It could be a coincidence on Acers part... My Acer tech support query has been elevated to level 2, but I must wait until Monday till level 2 techs are available. Level 1 wanted my BIOS upgraded before proceeding.

Yes, it applies to x86 and x86-64 (aka amd64, EM64T or x64) machines. If you have the logo and there isn't an option to disable Secure Boot. If there is not such an option than this is a fraud from Acer and you should even be able to sue them.

I second that; sue; indubitably-
:hattip:

ACER BIOS INFORMATION
http://i1353.photobucket.com/albums/...5F1EF89C3C.jpg

LEGACY BOOT (FOR COMPARISON)
http://i1353.photobucket.com/albums/...5DD18CA276.jpg

UEFI SECURE BOOT ENABLED (LOCKED IN AND GRAYED OUT)
http://i1353.photobucket.com/albums/...5DC77B0457.jpg

UEFI SECURE BOOT ENABLED (LOCKED IN AND GRAYED OUT) CLOSE UP
http://i1353.photobucket.com/albums/...5DC48E0340.jpg

As you can see its grayed out. Unlike the other options, I am unable to toggle it.

That makes me mad to hear that I should be able to unlock secure boot. I don't want to sue them, I would just like to disable it.

I did a Google Search "How to unlock secure boot when it is grayed out"

https://www.google.com/#hl=en&sugexp...w=1440&bih=736
Still looking to try to help-

I'll post back next week when I get a hold of Acer Tech Level 2 support. :S

http://www.windowsecurity.com/articl...s-mean-IT.html

If I learned anything from this. Make sure you play with the BIOS settings before you buy.

Difficult to check if secure boot can be enabled or disabled when buying a desktop/laptop online.

100% BS. Boy, there noses are getting longer and longer each day. I wonder what extra incentives MS gives the OEMs to lock down secure boot even if it has the logo. Hey MS, don't BS me, OK...

Acer Tech Level 2 support informed me that a BIOS password must be set to disable secure boot.

Strange as I have never put a password on the BIOS before.

I have a bad tendency to forget passwords that I never user. I wrote the password on the back of the laptop.

It's good that you wrote that psswrd down-
Have you now the Secure Boot disabled?

Yes I have secure boot disabled. An administrative BIOS password is necessary to disable secure boot.

Thanks for posting back. While I can see the reason for setting up that password when disabling Secure Boot, this should without any question have at least been documented in the manual.

great work snmcdonald this is good to know

Good luck with that. I mentioned that to the Level 2 Tech. Acer provides a kb article on disabling secure boot but does not mention this caveat. I recommended adding a foot note at the very least.

I talked to three different level 1 techs and the one that recommended me to level 2 did not write up an advance notice so I had to re-explain the whole scenario on Monday to another level 1 tech. I doubt they will record it, hopefully somebody with this Acer problem stumbles upon this thread.

Thanks Command Guru

I do feel stupid though, the solution is so simple. I've never bothered with BIOS passwords though.