[sf-lug] Notes on a Secure Boot, Ubuntu Install on a Toshiba

[Ken Shaffer]

I recently got to look at putting Ubuntu on a new Toshiba Satellite
S855-S5378.

Since my old HP laptop is always potentially just a day away from its third
motherboard meltdown, I am always looking at laptops when they are on
sale.  Toshibas like this one have been offered by OfficeDepot (and
TigerDirect with rebate), for about four months. I was aware
that this was far from an ideal Linux machine -- secure boot key problems,
ethernet problems, and wireless problems. Secure Boot could be disabled,
but there was no legacy BIOS support. I didn't have high hopes but was
pleasantly surprised.

The Good, The Bad, and The Ugly, Summary

Good:
 1) Boots the Ubuntu 64 bit versions of 12.10 and 12.04.2 in secure mode.
 2) Installs Ubuntu just fine (the first time).
 3) The first (wireless) update fixes ethernet, getting the needed alx
driver.
 4) Wireless for the rtl8723e chip does have an available tarball which
works,
    its just not directly from the vendor:
    rtl_92ce_92se_92de_8723ae_
linux_mac80211_0007.0809.2012.tar.gz
 5) Video, sound, bluetooth, and the webcam all work fine.
 6) The secure boot keys have been straightened out with firmware 6.60,
    which came with the machine.
 7) The USB3 ports work fine as USB2, even for booting.
 8) Runs cool, no overheating here.
 9) USB live-media created on the system still work in non-UEFI machines.

Bad:
 1) Wipes out Windows boot at the first Ubuntu install -- WAIT, maybe
    that's GOOD, depending upon your viewpoint.
 2) Wipes out the Ubuntu EFI files the second install (maybe third)
    (added myself to bug 1090829).
 3) Cannot boot Windows from grub (bug 1091434) on this machine.
 4) The live-media USB stick, set up on either a 32 bit 12.04 laptop with
    persistence, or the current 64 bit 12.10 Secure Boot/UEFI machine, loses
    persistence when booted on the Secure Boot/UEFI machine (bug 1159016).
 5) Installing to a GPT USB stick, and selecting grub location to be the
    stick, will still result in writing the Ubuntu info to the EFI hard
disk,
    and wiping out the Windows boot.  Should probably get a warning when
    leaving off the EFI partition, like when you leave off the swap
    partition.

Ugly:
 1) Really a lot of confusing/conflicting info on the web about secure
boot and UEFI. Each vendor may have a different set of problems.   Things
are in rapid flux, and last year's problems/solutions are not necessariy
applicable.  Even Toshiba got the key databases mixed up, and needed a
firmware update (to 6.60) to enable Ubuntu secure boot.
 2) The Ubuntu installer seems to clobber it's own files at times, leaving
things in a bad state whose fix is not obvious. It is really easy to leave
a machine unbootable from it's hard disk.
 3) Basic problems still are present, like Grub2 not being able to
chainload the Windows boot manager on some (like this one)  machines.

But on the whole, there is a lot of Good, and I am happy to report that a
working secure Ubuntu/Windows dual boot is possible (albeit using a USB
stick to boot Ubuntu running on the hard disk).  If you're quick on the
F12 key at boot time, you can even boot Windows off the hard disk without
having to remove the USB stick.  Oh, about secure boot on the stick:
Put the shim.efi file into EFI/Boot and rename it to bootx64.efi.
Put the signed grubx64.efi into EFI/Boot, and put the grub.cfg into
EFI/ubuntu.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://linuxmafia.com/pipermail/sf-lug/attachments/20130331/e92244c1/attachment.html>