Contemplating a complex UEFI-based Linux installation
I have a Lenovo P51 laptop here (currently running Microsoft Windows 10) on which I'm contemplating installing Linux - probably Arch Linux, or perhaps Debian Testing - or another distribution that is kept fairly up to date. Arch is of interest in that the packages are kept fairly close to upstream, which could be useful for some of my purposes (e.g., reporting bugs on accessibility-related tools such as braille display software and screen readers, and compiling development versions thereof). I need to keep Microsoft Windows around for work purposes, due to compatibility issues. I'm contemplating a dual-boot configuration. I would rather not turn off Microsoft's virtualization-based security, which requires Secure Boot to be enabled; unfortunately, there are too many vulnerabilities and plenty of Windows malware is circulating. On the Windows side, I have enabled Device Guard and Credential Guard in local group policy, set to require "secure boot with UEFI lock". I don't know whether this will complicate Linux installation, or whether it will need to be disabled, even temporarily. At this point, neither an Arch ISO image (written to a USB drive with dd) nor a GRML64 image will boot. I suspect Secure Boot is responsible, unless of course this system cannot boot from these prepared ISO images. I've read documentation on the Arch wiki and elsewhere about UEFI and Secure Boot, most of which is not very clear or somewhat incomplete. There are several boot loaders from which to choose, for example, as well as complications with Secure Boot. I've installed Arch before (and Debian more than once), but only on BIOS-based systems and never with another operating system also present. Further, there are various reports of mixed success with Linux on this particular laptop model. It isn't clear what information is up to date. Also, I want to avoid corrupting the UEFI firmware or data in ways that would necessitate board replacement; I've had to deal with unrelated hardware issues recently and definitely don't want to have to go through the pain of that experience again, if I can avoid it. So, what would be my best source of advice at this point on how to proceed? Suggestions and links would be welcome. I'm also willing to discuss it with someone who knows UEFI well, if necessary.
Juts in case................................. A lot of more recent bios's will NOT boot from a cd/dvd rom or usb key unless you specifcly enable this feature on a one time only bassis, ie one needs to enable this for every boot from such a device. Lindsay ----- Original message ----- From: Jason White via luv-main <luv-main@luv.asn.au> To: luv-main <luv-main@luv.asn.au> Subject: Contemplating a complex UEFI-based Linux installation Date: Wednesday, January 23, 2019 10:57 AM I have a Lenovo P51 laptop here (currently running Microsoft Windows 10) on which I'm contemplating installing Linux - probably Arch Linux, or perhaps Debian Testing - or another distribution that is kept fairly up to date. Arch is of interest in that the packages are kept fairly close to upstream, which could be useful for some of my purposes (e.g., reporting bugs on accessibility-related tools such as braille display software and screen readers, and compiling development versions thereof). I need to keep Microsoft Windows around for work purposes, due to compatibility issues. I'm contemplating a dual-boot configuration. I would rather not turn off Microsoft's virtualization-based security, which requires Secure Boot to be enabled; unfortunately, there are too many vulnerabilities and plenty of Windows malware is circulating. On the Windows side, I have enabled Device Guard and Credential Guard in local group policy, set to require "secure boot with UEFI lock". I don't know whether this will complicate Linux installation, or whether it will need to be disabled, even temporarily. At this point, neither an Arch ISO image (written to a USB drive with dd) nor a GRML64 image will boot. I suspect Secure Boot is responsible, unless of course this system cannot boot from these prepared ISO images. I've read documentation on the Arch wiki and elsewhere about UEFI and Secure Boot, most of which is not very clear or somewhat incomplete. There are several boot loaders from which to choose, for example, as well as complications with Secure Boot. I've installed Arch before (and Debian more than once), but only on BIOS-based systems and never with another operating system also present. Further, there are various reports of mixed success with Linux on this particular laptop model. It isn't clear what information is up to date. Also, I want to avoid corrupting the UEFI firmware or data in ways that would necessitate board replacement; I've had to deal with unrelated hardware issues recently and definitely don't want to have to go through the pain of that experience again, if I can avoid it. So, what would be my best source of advice at this point on how to proceed? Suggestions and links would be welcome. I'm also willing to discuss it with someone who knows UEFI well, if necessary. _______________________________________________ luv-main mailing list luv-main@luv.asn.au https://lists.luv.asn.au/cgi-bin/mailman/listinfo/luv-main
I looked at this a while back for Ubuntu on my laptop the most recent time I rebuilt it. Specifically I was increasing the size of the boot partition so I didn't run out of space. Read a lot of articles on setting it up, but don't have the details any more. But the good news is that it's definitely possible. IIRC the biggest challenge was working out what bios setting needed to be... On Wed, 23 Jan. 2019, 18:43 Lindsay W via luv-main <luv-main@luv.asn.au wrote:
Juts in case................................. A lot of more recent bios's will NOT boot from a cd/dvd rom or usb key unless you specifcly enable this feature on a one time only bassis, ie one needs to enable this for every boot from such a device.
Lindsay
----- Original message ----- From: Jason White via luv-main <luv-main@luv.asn.au> To: luv-main <luv-main@luv.asn.au> Subject: Contemplating a complex UEFI-based Linux installation Date: Wednesday, January 23, 2019 10:57 AM
I have a Lenovo P51 laptop here (currently running Microsoft Windows 10) on which I'm contemplating installing Linux - probably Arch Linux, or perhaps Debian Testing - or another distribution that is kept fairly up to date. Arch is of interest in that the packages are kept fairly close to upstream, which could be useful for some of my purposes (e.g., reporting bugs on accessibility-related tools such as braille display software and screen readers, and compiling development versions thereof).
I need to keep Microsoft Windows around for work purposes, due to compatibility issues. I'm contemplating a dual-boot configuration. I would rather not turn off Microsoft's virtualization-based security, which requires Secure Boot to be enabled; unfortunately, there are too many vulnerabilities and plenty of Windows malware is circulating.
On the Windows side, I have enabled Device Guard and Credential Guard in local group policy, set to require "secure boot with UEFI lock". I don't know whether this will complicate Linux installation, or whether it will need to be disabled, even temporarily.
At this point, neither an Arch ISO image (written to a USB drive with dd) nor a GRML64 image will boot. I suspect Secure Boot is responsible, unless of course this system cannot boot from these prepared ISO images.
I've read documentation on the Arch wiki and elsewhere about UEFI and Secure Boot, most of which is not very clear or somewhat incomplete. There are several boot loaders from which to choose, for example, as well as complications with Secure Boot. I've installed Arch before (and Debian more than once), but only on BIOS-based systems and never with another operating system also present. Further, there are various reports of mixed success with Linux on this particular laptop model. It isn't clear what information is up to date.
Also, I want to avoid corrupting the UEFI firmware or data in ways that would necessitate board replacement; I've had to deal with unrelated hardware issues recently and definitely don't want to have to go through the pain of that experience again, if I can avoid it.
So, what would be my best source of advice at this point on how to proceed? Suggestions and links would be welcome. I'm also willing to discuss it with someone who knows UEFI well, if necessary.
_______________________________________________ luv-main mailing list luv-main@luv.asn.au https://lists.luv.asn.au/cgi-bin/mailman/listinfo/luv-main _______________________________________________ luv-main mailing list luv-main@luv.asn.au https://lists.luv.asn.au/cgi-bin/mailman/listinfo/luv-main
Hello Jason, On 1/23/19, Jason White via luv-main <luv-main@luv.asn.au> wrote:
I have a Lenovo P51 laptop here (currently running Microsoft Windows 10) on which I'm contemplating installing Linux - probably Arch Linux, or perhaps Debian Testing - or another distribution that is kept fairly up to date. Arch is of interest in that the packages are kept fairly close to upstream, which could be useful for some of my purposes (e.g., reporting bugs on accessibility-related tools such as braille display software and screen readers, and compiling development versions thereof).
Thank you for being involved in such ways. I know another blind computer user, but in the USA, who is effectively tied to Microsoft, and loathes it. As a diabetic, braille output is not an option, and should the screen reader not work, the computer is unusable, and very difficult to fix, they have "sighted minions" who are far from computer literate. As such the BIOS screens are unavailable.
I need to keep Microsoft Windows around for work purposes, due to compatibility issues. I'm contemplating a dual-boot configuration. I would rather not turn off Microsoft's virtualization-based security, which requires Secure Boot to be enabled; unfortunately, there are too many vulnerabilities and plenty of Windows malware is circulating.
I can understand and sympathize. Requiring the use of Microsoft software says someone is not competent. That is not you.
On the Windows side, I have enabled Device Guard and Credential Guard in local group policy, set to require "secure boot with UEFI lock". I don't know whether this will complicate Linux installation, or whether it will need to be disabled, even temporarily.
At this point, neither an Arch ISO image (written to a USB drive with dd) nor a GRML64 image will boot. I suspect Secure Boot is responsible, unless of course this system cannot boot from these prepared ISO images.
Were I any way close, I would like to offer to be your eyes for the BIOS and the like before the OS comes up. Whether it comes up on the braille output, it may miss out on some characters outside the standard ASCII set. That may be significant.
I've read documentation on the Arch wiki and elsewhere about UEFI and Secure Boot, most of which is not very clear or somewhat incomplete. There are several boot loaders from which to choose, for example, as well as complications with Secure Boot. I've installed Arch before (and Debian more than once), but only on BIOS-based systems and never with another operating system also present. Further, there are various reports of mixed success with Linux on this particular laptop model. It isn't clear what information is up to date.
Also, I want to avoid corrupting the UEFI firmware or data in ways that would necessitate board replacement; I've had to deal with unrelated hardware issues recently and definitely don't want to have to go through the pain of that experience again, if I can avoid it.
So, what would be my best source of advice at this point on how to proceed? Suggestions and links would be welcome. I'm also willing to discuss it with someone who knows UEFI well, if necessary.
Knowing UEFI is the start, being there and seeing what messages flash up on the monitor, and then disappear is also important. I suspect that partial and poor implementations of UEFI may well be adding to the confusion and misinformation you see. To finish, some questions. When you browse a website, does the braille output include all the HTML, or just the text, or can you toggle between how much you get? Does the braille output work with the BIOS?UEFI screens? Is there a braille output device that also "speaks" the output? Regards, Mark Trickett
Just to answer the questions below: The braille output is controlled by whatever screen reader is in use, and screen readers are specific to each operating system. There is no output available until the screen reader is loaded (it's the same with text to speech in that respect). I recall an effort to integrate braille support into Grub, so that one could access the Grub menus independently. I can't remember how far that progressed, but I know where to ask. There's one possible option for enabling me to read BIOS/UEFI menus, namely remote administration facilities. The Lenovo P51 laptop, for example, has Intel Management Engine installed, though not presently configured. If it supports a serial console or similar, I could access it from another machine. I haven't investigated the details, but I'm interested. -----Original Message----- From: Mark Trickett <marktrickett@gmail.com> Sent: Wednesday, January 23, 2019 4:33 AM To: Jason White <jason@jasonjgw.net>; luv-main <luv-main@luv.asn.au> Subject: Re: Contemplating a complex UEFI-based Linux installation Hello Jason, On 1/23/19, Jason White via luv-main <luv-main@luv.asn.au> wrote:
I have a Lenovo P51 laptop here (currently running Microsoft Windows 10) on which I'm contemplating installing Linux - probably Arch Linux, or perhaps Debian Testing - or another distribution that is kept fairly up to date. Arch is of interest in that the packages are kept fairly close to upstream, which could be useful for some of my purposes (e.g., reporting bugs on accessibility-related tools such as braille display software and screen readers, and compiling development versions thereof).
Thank you for being involved in such ways. I know another blind computer user, but in the USA, who is effectively tied to Microsoft, and loathes it. As a diabetic, braille output is not an option, and should the screen reader not work, the computer is unusable, and very difficult to fix, they have "sighted minions" who are far from computer literate. As such the BIOS screens are unavailable.
I need to keep Microsoft Windows around for work purposes, due to compatibility issues. I'm contemplating a dual-boot configuration. I would rather not turn off Microsoft's virtualization-based security, which requires Secure Boot to be enabled; unfortunately, there are too many vulnerabilities and plenty of Windows malware is circulating.
I can understand and sympathize. Requiring the use of Microsoft software says someone is not competent. That is not you.
On the Windows side, I have enabled Device Guard and Credential Guard in local group policy, set to require "secure boot with UEFI lock". I don't know whether this will complicate Linux installation, or whether it will need to be disabled, even temporarily.
At this point, neither an Arch ISO image (written to a USB drive with dd) nor a GRML64 image will boot. I suspect Secure Boot is responsible, unless of course this system cannot boot from these prepared ISO images.
Were I any way close, I would like to offer to be your eyes for the BIOS and the like before the OS comes up. Whether it comes up on the braille output, it may miss out on some characters outside the standard ASCII set. That may be significant.
I've read documentation on the Arch wiki and elsewhere about UEFI and Secure Boot, most of which is not very clear or somewhat incomplete. There are several boot loaders from which to choose, for example, as well as complications with Secure Boot. I've installed Arch before (and Debian more than once), but only on BIOS-based systems and never with another operating system also present. Further, there are various reports of mixed success with Linux on this particular laptop model. It isn't clear what information is up to date.
Also, I want to avoid corrupting the UEFI firmware or data in ways that would necessitate board replacement; I've had to deal with unrelated hardware issues recently and definitely don't want to have to go through the pain of that experience again, if I can avoid it.
So, what would be my best source of advice at this point on how to proceed? Suggestions and links would be welcome. I'm also willing to discuss it with someone who knows UEFI well, if necessary.
Knowing UEFI is the start, being there and seeing what messages flash up on the monitor, and then disappear is also important. I suspect that partial and poor implementations of UEFI may well be adding to the confusion and misinformation you see. To finish, some questions. When you browse a website, does the braille output include all the HTML, or just the text, or can you toggle between how much you get? Does the braille output work with the BIOS?UEFI screens? Is there a braille output device that also "speaks" the output? Regards, Mark Trickett
Hi Jason, In June last year, I bought myself a Lenovo Thinkpad E580 laptop. It also came with Windows 10 pre-installed. After googling around the web and some research, I managed to gather a fair bit of info, knowledge bases, how-to forums, etc on how to dual-boot this PC. Later, I successfully installed Ubuntu 18.04, dual-booting with the existing Windows 10 (which I hardly used ever since). Then in August, I compiled all my notes on my dual-boot install experience and gave a talk in that month's LUV Beginners Workshop. Please find attached my notes (in Markdown format). I didn't include any of the images linked in this notes, but they are just screenshots of my installation. All the useful URLs are near the end of this notes, under References & Resources. Some points to note: - As I had mentioned in my notes, the most important part is a number of preparatory steps. After that, the actual Distro installation itself is usually easy. - Among them, is to keep the UEFI mode (rather than reverting to the 'Legacy' mode), but have the "Secure Boot" turned off (disabled). - Even though a lot of online resources and opinions out there are saying that the most recent Linux distros (e.g. Ubuntu since a couple of years ago) can co-exist with Secure Boot enabled just fine, the majority of the opinions I had come across suggest turning off secure boot before installing a dual-boot linux - for the peace of mind down the track. - For my new Thinkpad, its secure boot was disabled by default when I got it - so I am not sure whether your existing Windows 10 would still boot if you disabled the secure boot that was enabled by default. (Online opinions generally suggest the outcome tend to be dependent on the manufacturer of the PC or its BIOS/UEFI). Did your Lenovo P51 come with secure boot On or Off? - Another thing I found important is the shrinking of your Windows disk partition to make way for your Linux distro install. In a sense this also depends on the size of your PC's hard disk. If your disk is large (say from 500 GB to 1 or more TB), then you can just use the Windows built-in Disk Management tool to shrink your Windows partition to as low as you can get - but this usually gives you a blank partition that is less than half of the total disk size. However, if your laptop disk is relatively small (like mine, which is a SSD with only 256 GB), then you can consider using a third-party Windows tool - say: AOMEI Partition Assistant Standard (free) - which can allow you to squeeze/shrink your Windows disk partition to even further - to slightly lower than half the total disk space - thereby giving you a larger blank partition to install your distro. (A couple of URLs in my notes talk about this in great details). I hope my notes here can be of help to your dual-boot attempt. I'm sure you will get there eventually! All the best! Regards, Wen On Wed, Jan 23, 2019 at 11:54 PM Jason White via luv-main < luv-main@luv.asn.au> wrote:
Just to answer the questions below:
The braille output is controlled by whatever screen reader is in use, and screen readers are specific to each operating system. There is no output available until the screen reader is loaded (it's the same with text to speech in that respect). I recall an effort to integrate braille support into Grub, so that one could access the Grub menus independently. I can't remember how far that progressed, but I know where to ask.
There's one possible option for enabling me to read BIOS/UEFI menus, namely remote administration facilities. The Lenovo P51 laptop, for example, has Intel Management Engine installed, though not presently configured. If it supports a serial console or similar, I could access it from another machine. I haven't investigated the details, but I'm interested.
-----Original Message----- From: Mark Trickett <marktrickett@gmail.com> Sent: Wednesday, January 23, 2019 4:33 AM To: Jason White <jason@jasonjgw.net>; luv-main <luv-main@luv.asn.au> Subject: Re: Contemplating a complex UEFI-based Linux installation
Hello Jason,
On 1/23/19, Jason White via luv-main <luv-main@luv.asn.au> wrote:
I have a Lenovo P51 laptop here (currently running Microsoft Windows 10) on which I'm contemplating installing Linux - probably Arch Linux, or perhaps Debian Testing - or another distribution that is kept fairly up to date. Arch is of interest in that the packages are kept fairly close to upstream, which could be useful for some of my purposes (e.g., reporting bugs on accessibility-related tools such as braille display software and screen readers, and compiling development versions thereof).
Thank you for being involved in such ways. I know another blind computer user, but in the USA, who is effectively tied to Microsoft, and loathes it. As a diabetic, braille output is not an option, and should the screen reader not work, the computer is unusable, and very difficult to fix, they have "sighted minions" who are far from computer literate. As such the BIOS screens are unavailable.
I need to keep Microsoft Windows around for work purposes, due to compatibility issues. I'm contemplating a dual-boot configuration. I would rather not turn off Microsoft's virtualization-based security, which requires Secure Boot to be enabled; unfortunately, there are too many vulnerabilities and plenty of Windows malware is circulating.
I can understand and sympathize. Requiring the use of Microsoft software says someone is not competent. That is not you.
On the Windows side, I have enabled Device Guard and Credential Guard in local group policy, set to require "secure boot with UEFI lock". I don't know whether this will complicate Linux installation, or whether it will need to be disabled, even temporarily.
At this point, neither an Arch ISO image (written to a USB drive with dd) nor a GRML64 image will boot. I suspect Secure Boot is responsible, unless of course this system cannot boot from these prepared ISO images.
Were I any way close, I would like to offer to be your eyes for the BIOS and the like before the OS comes up. Whether it comes up on the braille output, it may miss out on some characters outside the standard ASCII set. That may be significant.
I've read documentation on the Arch wiki and elsewhere about UEFI and Secure Boot, most of which is not very clear or somewhat incomplete. There are several boot loaders from which to choose, for example, as well as complications with Secure Boot. I've installed Arch before (and Debian more than once), but only on BIOS-based systems and never with another operating system also present. Further, there are various reports of mixed success with Linux on this particular laptop model. It isn't clear what information is up to date.
Also, I want to avoid corrupting the UEFI firmware or data in ways that would necessitate board replacement; I've had to deal with unrelated hardware issues recently and definitely don't want to have to go through the pain of that experience again, if I can avoid it.
So, what would be my best source of advice at this point on how to proceed? Suggestions and links would be welcome. I'm also willing to discuss it with someone who knows UEFI well, if necessary.
Knowing UEFI is the start, being there and seeing what messages flash up on the monitor, and then disappear is also important. I suspect that partial and poor implementations of UEFI may well be adding to the confusion and misinformation you see.
To finish, some questions. When you browse a website, does the braille output include all the HTML, or just the text, or can you toggle between how much you get? Does the braille output work with the BIOS?UEFI screens? Is there a braille output device that also "speaks" the output?
Regards,
Mark Trickett
_______________________________________________ luv-main mailing list luv-main@luv.asn.au https://lists.luv.asn.au/cgi-bin/mailman/listinfo/luv-main
Thank you, Wen - these observations are helpful and valuable. In my case, the machine came with Secure Boot enabled. I understand that there is malware which targets the boot process, but it's also true that Secure Boot complicates life for Linux users and distributors considerably. Thus, it's both a useful security measure and a source of problems. If the PC architecture declines, it may become even harder to install Linux on readily available hardware. Linux is going to need support from system manufacturers - including those who specialize in Linux itself.
I now have a working, text-based Arch Linux installation on the laptop in question. Secure Boot is off for the moment. I plan next to install a graphical desktop environment and the Orca screen reader. (I've raised questions on the relevant mailing list.) This laptop has two GPUs, an Intel GPU and an NVidia GPU. I think it's NVidia Optimus. Where would I find current information on how to configure it? I would prefer not to take the proprietary driver route (i.e., Nouveau drivers would be best, if possible). Arch Linux has the bbswitch package, which is for Optimus laptops. Although I can't see what is on screen, other people may need to look at it, and I also may wish to give presentations using an external display. So it's worth getting the graphics working.
participants (5)
-
Jason White -
Lindsay W -
Mark Trickett -
Paul van den Bergen -
Wen Lin