Skip to content

Instantly share code, notes, and snippets.

@Jiab77

Jiab77/install-elementary-os-juno-on-secureboot-efi-enabled-computer.md

Last active December 15, 2022 00:32
Show Gist options
  • Star 4 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Jiab77/a8be4368654170fc9fd8bc55c85c21cd to your computer and use it in GitHub Desktop.
Save Jiab77/a8be4368654170fc9fd8bc55c85c21cd to your computer and use it in GitHub Desktop.
Download ZIP
Install ElementaryOS Juno on SecureBoot + EFI enabled computer
Raw
install-elementary-os-juno-on-secureboot-efi-enabled-computer.md

Install ElementaryOS Juno on SecureBoot + EFI enabled computer

Yet another night passed to fight with the machine. 💪

I was really happy to know that the latest version of ElementaryOS were out so I could not wait to install it on my latest laptop Acer Predator. 🤘 But... as usual, it was not without troubles...

Compatible with SecureBoot + EFI enabled computers? Awesome!!

But not really in fact... It might work for some brands but for my Acer Predator... not at all. Well it can work but will requires the steps explained below.

If you're in a hurry, jump to "Remove the buggy boot entries".

Start the install process

The only slight change you will have to do from your habits is to use the live mode instead of the install mode to process to the installation. This is required to fix the installed bootloader otherwise you will not be able to boot correctly.

Note: If you haven't got any issues using the normal install process and everything worked directly right after the first boot, then you can skip the whole gist and tell to yourself that you're from the lucky ones that didn't had any issues during their first installation. 👍

Debugging the EFI boot loader

The first difficulty was to get enough time to capture the error message as it was disapearing almost right once displayed.

image

Bug description

Apparently, when the installer failed to setup the bootloader and SecureBoot correctly, it creates a bootloop right after the next reboot required to finish the installation.

On each boot loops, it fails to detect the correct boot entry from the EFI NVRAM, adds default entries, then force reboot to use the new added entries. But at the next reboot, it fails again to detect the correct boot entry and restart the process infinitely...

Some constructors like Acer, requires to trust the boot file when SecureBoot is enabled. This means you will need add the file that need to be trusted manually in your EFI BIOS settings.

image

Bootloop impact

image

As you may see, two entries got created on each boot loops.

Clean the EFI NVRAM before patching

Before I could find a proper solution after some long researching and testing hours, I got multiple bootloops times and so, got a lot of buggy boot entries to remove...

I got around 50 buggy boot entries to remove and required to specify them one by one...

Remove the buggy boot entries

The process is not really handy but thanks to the live mode to make it easier otherwise... I don't even imagine 😅.

  1. Boot in live mode by selecting option "Try ElementaryOS..."
  2. Connect to your network (ethernet or wireless but Internet is required)
  3. Download and install efibootmgr package: sudo apt install efibootmgr
  4. List your current boot entries: sudo efibootmgr -v
  5. Check the id you want to remove starting by Boot[id in hex], example: Boot002A -> 002A is the id in hex to use
  6. Remove the wanted entry by running: sudo efibootmgr -b [id in hex] -B -v (-v is used to display more info)

If you have several entries to remove as I had, you might to need to use a loop to remove them all that way:

image

for ID in 000E 000F 0010 0011 0012 0013 0014 0015 0016 0017; do sudo efibootmgr -b $ID -B -v; done

image

Entries starting by PciRoot(0x0)/Pci(0x17,0x0)/Sata(3,32768,1)/ will be removed from the BIOS.

Dont't try to remove them manually because they'll be readded by the BIOS as the next boot...

I will explain the method later.

Patch the bootloader

The following steps will help you to solve your boot issue.

Trust your bootloader file

Now that you have cleaned your EFI NVRAM with the method above, you can start to breath a little as the following will fix your issue and let you enjoy your lovelly ElementaryOS Juno 😋.

1. Check the boot entry added during the installation process

image

Here, you will need to check the given file, in my case it is this one: /File(\EFI\ubuntu\shimx64.efi).

2. Reboot and define the required file

image image image image image image image

3. Save changes and open the boot menu

In case the boot menu is not enabled already, you will need to enable it before continue.

I used F12 as boot menu key. Might be different in your case.

image

4. Testing

If the trust procedure worked correctly, you should have a new line in your boot menu as shown in the picture above. Now boot using this new entry.

Once done and you haven't got any displayed error message and having this result:

image

Only if you have selected full disk encryption option during the installation process.

image

I'm sure you love my camera privacy patch 😄

image

You can do anything you want but celebrate it! 🎉🍻😁. The worst is behind you 😉.

Making changes permanent

As said previously, the worst is behind you and I don't think you want to make all these steps again... So you'll need to make your changes permananent and not having to use the boot menu to boot correctly each times.

I assume here that everything worked correctly on your side and you get the same result as I have to proceed to the next steps. If not, I'm really sorry for you but you'll need some additionnal debugging times, write a comment and I'll try to help you.

Open your session using the login screen then open the terminal app and run these commands:

# List your boot entries.
#
# The faulty entry '0000' is the one added by the installer
# It should be defined as `BootCurrent` on top of the command output.
# Nothing wrong if it doesn't, continue anyway.
#
# sudo efibootmgr -v
# BootCurrent: 0000
sudo efibootmgr -v

# Define the boot order to include your added boot entry from BIOS
# Don't do it if it's already included in the previous command output.
# In my case '0002' was already added by the BIOS apparently.
sudo efibootmgr -o 0001,0002,2001,2002,2003

# Define the next entry to use for boot.
# Replace '0002' by your boot entry.
sudo efibootmgr -n 0002 -v

image

Now you should see something like BootNext: [your given id] in the last command output.

Now you can reboot using sudo reboot and start to cross your fingers. If you see your login screen without having to use the boot menu, you have solved your boot issue! 🎊

Last check

In order to make sure that everything will now working correctly on each boots, just check a last time your boot settings.

$ sudo efibootmgr -v
BootCurrent: 0002
Timeout: 0 seconds
BootOrder: 0001,0002,0007,0008,0009,2001,2002,2003
Boot0000* ubuntu	HD(1,GPT,9bd24b9a-f584-4a14-919b-dd7878c2aff1,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)
Boot0001* Command Linpus lite	HD(1,GPT,9bd24b9a-f584-4a14-919b-dd7878c2aff1,0x800,0x100000)/File(\EFI\Boot\bootx64.efi)RC
Boot0002* Elementary	PciRoot(0x0)/Pci(0x17,0x0)/Sata(3,32768,1)/HD(1,GPT,9bd24b9a-f584-4a14-919b-dd7878c2aff1,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)A01 ..

Lines starting by PciRoot(0x0)/Pci(0x17,0x0)/ are lines added from trust procedure.

I guess lines finishing by RC are the default ones added dynamically by the BIOS itself.

Other guess would be that A01 is the slot id from the trust store... Which corresponding to the first entry I've added during my testing.

If the BootCurrent is set to your defined id, then you've definitely fixed your issue! 😎 🤘

Final result:

image

Other PciRoot(0x0)/Pci(0x17,0x0)/ lines will be removed with the procedure below and I will just keep the one named Elementary. They are the results from my several attempts to make it works...

Feel free to comment, I'd be pleased to know that my gist helped you to solve your issue. 😊

Remove entries added from EFI BIOS

As said earlier in this gist, I will explain how to remove entries added from EFI BIOS but I'm not sure you will have the settings as I have.

image image

Having this fact in mind, I won't be responsible if you damage your computer if you proceed without having the same settings as displayed.

Use the showed option to remove the entries you have added manually. Myself included, I can't select which entries I want to deleted so this will delete all entries... Make sure you want continue, otherwise don't do it!

If you really want to continue, then press [enter] on both options to clear them all. Once done, add the entry used during the trust procedure, otherwise I'm not sure you would be able to boot after that.

Save and restart to apply changes. Go back to the EFI BIOS to re-add your custom entry again if you want to be able to boot ElementaryOS Juno. (proceed as explained in this gist)

image image image

Display issues with some applications

At the time I'm writing this gist, there is an issue that impacting applications based on wxPython. Applications like PlayOnLinux and BOINC Manager are impacted. See there for updates: elementary/gala#244

Drama

As usual, it was not easy to get a clear and concise way to fix the issue and it required long research times before finding a solution after several unsuccessful attempts...

References

For once, I'm not sure that I was able to save all the used reference as I was forced to run in live mode to do research and testing on the computer having the issue and I used Telegram Web to save the most usefull links, so I may miss some probably. Let me know in comments if you need more info.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment