Unbuntu on Windows 8 Developer Preview PC

[SteveRiley]

Posted this over on the Ubuntu forum; thought you fine folks here might be interested so I'm just letting you know in case you want to follow the progress...

I attended Microsoft's //build/ conference a couple weeks ago and picked up one of those new "developer preview" tablet/slate PCs. This is a tricked-out Samsung slate of some kind; either it is or it isn't a variant of the forthcoming Series 7 slates. Last night I thought I'd see whether I could get Ubuntu to at least boot on my shiny new toy.

Continue reading...

[GreyGeek]

Re: Unbuntu on Windows 8 Developer Preview PC

I've been reading about that over the last few days. At first folks were blaming Microsoft, but Microsoft is blaiming the hardware manufacturers.

Earlier this week Red Hat Linux developer Matthew Garrett raised this point, and the issue gained a bit of traction in the blogosphere. The original post wasn’t particularly alarming, since there was no suggestion that Microsoft was trying to kill Linux. But it certainly raised some cause for concern. Now Microsoft’s Steven Sinofsky has weighed in to clarify the company’s stance on the matter.

In a nutshell it comes down to this: In order to slap a Windows logo on a Windows 8 PC, hardware makers will have to ensure that secure boot is turned on by default. But there’s absolutely nothing preventing PC makers from giving customers the option to turn off that setting.

Of course, there’s also nothing requiring them to do so. That was kind of Garrett’s point in the first place. It’s not that the HPs, Acers, Dells, and Lenovos of the world are likely to ship computers that intentionally prevent users from installing Linux alongside Windows 8. It’s just that this is something most customers won’t bother to do… and so it’s possible that some companies won’t bother to make sure the UEFI included with their prebuilt computer systems include an option to disable secure boot.
...
The fear expressed by the Linux community in June was that proprietary operating system vendors could demand an implementation of Secure UEFI where device makers do not or cannot share private keys with the buyers/users of the device. Without that, only the entities in the signature database will be able to authenticate drivers and OSes for the hardware.
...
We could also eventually see various Linux distributions take steps to enable support for UEFI secure boot features, but this is a tricky process since secure boot requires signed code — and that’s something that may conflict with the GPL (General Public License) used by most open source Linux-based operating systems.

The "solution" suggested by some is to "build a computer yourself with compatible parts". There are several things wrong with that:
1) It slants the PC OEM playing field even more towards Microsoft than the current situation. Now, at least, you can install Linux on a PC even if it comes with Windows preinstalled.
2) An unwanted Windows license just for the privilege of installing Linux dual boot, and preventing the overwrite of Windows by Linux...
3) Laptops, netbooks and notebooks aren't easily made from parts. In fact, I don't know of any one who is doing that or offering parts kits for sale.
4) It is a Microsoft + hardware lockin that is, to say the least, a restraint of trade, if not a violation of the Sherman-Clayton Antitrust act, which stipulates that Manufacturer A cannot require a consumer to purchase a product from Manufacturer B in order to get A's product to run.

About a year or so ago I recall rumors in the press that Microsoft was cooking up something with PC OEMS that would prevent anything but a preinstalled copy of Windows from running on the hardware. Now we know what that is.

My first thought for a workaround would be burning a different and more compatible bios. All we Linux users want, after all, is good hardware.

EDIT: A thought just occurred to me: Microsoft can claim that it is not they who are blocking a Linux dual boot or install, by claiming that it is the hardware vendors who control the disable switch, yet those vendors have to meet Microsoft licensing conditions. It's the parts of that licensing agreement that we haven't heard or read that is the "hand behind the curtain".

[SteveRiley]

Re: Unbuntu on Windows 8 Developer Preview PC

Well, so far, I've not been successful. If I pass the argument noefi to the linux command in GRUB, I do get status messages that show the kernel is booting. But after a few seconds it drops to an (initramfs) prompt. I can't type anything because there's no built-in keyboard; not enough of the kernel has loaded to enable my USB keyboard yet! This is with CMS support disabled, meaning UEFI only. If I enable CMS support, which supposedly provides BIOS backward compatibility, I'm still not getting past a blank screen after the GRUB menu.

GreyGeek, I'm not ready -- yet, anyway -- to blame Microsoft for my singular failure here. I simply don't know much at all about UEFI. I'm reluctant to pave the whole thing because I still want the Windows 8 running on the box to work -- it's actually kind of neat. I'll keep at this for a while, because I do love learning this stuff. Hell, I can barely hear the plaintive call of my lonely mountain bike anymore...

[dibl]

Re: Unbuntu on Windows 8 Developer Preview PC

Here is more good info on the UEFI/Secure Boot front:

http://mjg59.dreamwidth.org/#entry-5552

http://www.itwire.com/opinion-and-an...g-out-gnulinux

I have it secondhand that the EU has initiated an investigation into the anti-competitive potential of these plans. I hope that is true.

[GreyGeek]

Re: Unbuntu on Windows 8 Developer Preview PC

Well, so far, I've not been successful. ...

I read your post about this in the Ubuntu forum, where you describe what you did to try to solve the problem. Your attempts were technically brilliant, even if you were unsuccessful. As skilled as you are, and you are well above the level of most computer users, it seems that so far the only way you will be successful is to get the PC OEM to turn off UEFI for you or give you the key to your own machine. Does their agreement with Microsoft prevent them from doing so? I don't know but given Microsoft's past I suspect that not giving the key away is part of the MS licensing terms. You have also highlighted the fact that the average Joe and Sally Sixpack Linux user has a snowball's chance in Hell of getting Linux installed on a computer that has Win8 preinstalled, which, I believe, is the whole point of UEFI. After all, like I said before, what's the point of installing a bullet proof Titanium door on a house to prevent users from adding an extra room, if it has glass windows which are, for the most part, left wide open for thieves. The 4,500,000 Windows bot farm discovered last fall contained may boxes that had active AV running.

Microsoft's free Security Essentials is an excellent start to fulfilling Microsoft's obligation to provide a secure platform, but it is still letting zero-day exploits through. And, that is part of the problem. Microsoft has legally bludgeoned security houses, with threats of lawsuits, into giving information on holes they discover only to Microsoft itself, and then Microsoft sets on their list of exploits and fixes them only when it suits their bottom line. Then they have the chutzpah to announce the security hole and the patch on the same day, claiming a zero-day patch, leaving the impression that users were not risk because the hole was fixed before the bad guys knew about it. Unfortunately, FireFox and some other FOSS projects are adopting this scheme as well. The FOSS way of handling security holes is to announce them immediately upon discovery, along with a proof of concept code that tests any putative solution. That way, the user can decide for themselves if they will continue to use the risky program or uninstall it until it is patched.

[GreyGeek]

Re: Unbuntu on Windows 8 Developer Preview PC

Here is more good info on the UEFI/Secure Boot front:

http://mjg59.dreamwidth.org/#entry-5552
...

An anonymous comment to that URL remarked:

Instead, imagine a future where one can actually brick a motherboard from software. Imagine that in this future an exploit is found in win8 (unthinkable I know). Now suppose that a piece of scare-ware does this:

1. exploit windows, add a signed scare ware boot loader.
2. Add said signed software's key to white list.
3. Blacklist windows.

Before the best scare ware could do is take files hostage. The average user has some pretty valuable files, but rarely is there a dollar amount associated with these files. Instead, now scare ware can hold the entire computer hostage. Users know exactly how much they paid for the computer, and how much it would cost to replace or fix.

Physical control of a computer should always allow control.

There you have it, ladies and gentleman, the first and perfect Windows 8 hack. Go through the weakness link. While the bootloader may be the Titanium door, the "Windows" are still wide open.

[GreyGeek]

Re: Unbuntu on Windows 8 Developer Preview PC

Here is more good info on the UEFI/Secure Boot front:
'''''
http://www.itwire.com/opinion-and-an...g-out-gnulinux
....

And from your second URL a comment was posted by "ian_from_oz":

There is very little point in limiting what OS can be installed. The security problems for the computer only start after Windows has been booted.

If the hardware vendors are stupid enough to buy into this idea, then there will suddenly be a great market for computers without an OS or computers with Linux pre-installed. If for some reason the vendors are convinced to act against their own best interest, a lot more effort will be put into making Linux run better on MacBooks. I also can see some start up coming in to fill the void. In the cut-throat world of PC manufacturing, a few percentage points can make the difference between succeeding and failing.

It would only be a short time before the Linux BIOS project went into full swing to provide Linux friendly BIOS for common hardware. Hardware cracks would take no time before they arrive on the net.

Microsoft, being a marketing and litigation company, probably won't be so stupid as to go down this road. To do so would in effect be begging the question, where they don't want the answer to become public.

Q: What percentage of people are actually using Linux?
A: It is clearly a lot more than the <1% figure that the Microsoft marketing drones keep pushing.

Ian

The solution is coreboot combined with OpenBIOS.

[SteveRiley]

Re: Unbuntu on Windows 8 Developer Preview PC

I read your post about this in the Ubuntu forum, where you describe what you did to try to solve the problem. Your attempts were technically brilliant, even if you were unsuccessful. As skilled as you are, and you are well above the level of most computer users

I'm honored...thank you, kind sir.

it seems that so far the only way you will be successful is to get the PC OEM to turn off UEFI for you or give you the key to your own machine. Does their agreement with Microsoft prevent them from doing so? I don't know but given Microsoft's past I suspect that not giving the key away is part of the MS licensing terms.

No signing or validation keys are required if you want to completely bypass secure boot. For a lengthy discussion of UEFI and secure boot, read Sinofsky's recent blog post. One of the first things I had to do was disable the secure boot function just to get the system to even read the USB in the first place:

[img width=400 height=274]http://blogs.msdn.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-01-29-43-metablogapi/0624.Figure_2D00_5_2D002D002D00_Samsung_2D00_PC_2D 00_secured_2D00_boot_2D00_setting_5F00_thumb_5F00_ 02016A69.jpg[/img]

When set to "enabled," trying to boot from the USB immediately generated an error message indicating that the boot image is unsigned. Once I changed it to "disabled," I can get at least as far as I've documented. This indicates to me that UEFI security isn't the cause of my problem, something else is. I have a nagging suspicion it's a video driver issue. I'm going to experiment with some other distros, just to see if I can get some kind of boot to finish successfully.

You have also highlighted the fact that the average Joe and Sally Sixpack Linux user has a snowball's chance in Hell of getting Linux installed on a computer that has Win8 preinstalled, which, I believe, is the whole point of UEFI.

For OEMs to display a Windows 8 logo, alas, they will have to ship their products with secure boot enabled. To quote Sinofsky...

For Windows customers, Microsoft is using the Windows Certification program to ensure that systems shipping with Windows 8 have secure boot enabled by default, that firmware not allow programmatic control of secure boot (to prevent malware from disabling security policies in firmware), and that OEMs prevent unauthorized attempts at updating firmware that could compromise system integrity.

While I'm usually reluctant to read personal motives into technical decisions, I believe that this is a dangerous position for the company to take. I'll be the first in line to champion secure-by-default configurations; but I agree that this is going too far. This should be a choice left up to customers: UEFI needs to support a first-time-power-up menu that allows users to select their preferred default state. Furthermore, there should be a boot-time motherboard message that constantly reminds people which keypress is required to get into the configuration options.

[GreyGeek]

Re: Unbuntu on Windows 8 Developer Preview PC

....
While I'm usually reluctant to read personal motives into technical decisions, I believe that this is a dangerous position for the company to take. I'll be the first in line to champion secure-by-default configurations; but I agree that this is going too far. This should be a choice left up to customers: UEFI needs to support a first-time-power-up menu that allows users to select their preferred default state. Furthermore, there should be a boot-time motherboard message that constantly reminds people which keypress is required to get into the configuration options.

Your view is supported by a recent rehash of the UEFI fiasco by the FSF, reported at the Register:

Microsoft's system implements the Unified Extensible Firmware Interface (UEFI) firmware specification, only the system in Windows 8 would mean any Windows 8 PC that ships with only OEM and Microsoft keys will not boot a generic build of Linux.

The red flag was raised by Red Hat employee and tech blogger Matthew Garrett here and Professor Ross Anderson of Cambridge University here. Anderson said Secure Boot might violate EU competition law.

Microsoft, meanwhile, has shifted responsibility for Secure Boot to the PC manufacturers. In a blog response to the alarm, Microsoft ecosystem team member Tony Mangefeste wrote: "OEMs are free to choose how to enable this support and can further customize the parameters as described above in an effort to deliver unique value propositions to their customers."

However, it seems OEMs are not free to choose how to enable Secure Boot.

All About Microsoft's Mary-Jo Foley reports that at Microsoft's Build conference in California last month, Microsoft said support for UEFI Secure Boot is a Windows 8 certification requirement.

Meanwhile, on the Windows 8 blog in response to concern about UEFI, Mangefeste went on to claim: "At the end of the day, the customer is in control of their PC."

Responding to Mangefeste, Garrett called the rebuttal "entirely factually accurate", adding "but it's also misleading" – because the PC marker and Microsoft would maintain control over the keys needed to permit trusted code to boot on PCs.

From my POV, this situation is nothing less that restraint of free trade and competition by Microsoft and the PC OEMs acting in collusion, probably with an "ad rebate" gun being put to the OEMs heads.

[SteveRiley]

Re: Unbuntu on Windows 8 Developer Preview PC

This fiasco shows all the hallmarks of a classic finger-pointing maneuver. OEMs are free to do as they wish. Unless they want that "Windows 8" logo sticker. Then they lose their freedom. Oh but wait, no one's forcing the sticker. Oh yes, the market does, because no one will buy something without it. I believe the technical term for this is circle jerk.

BTW, I've temporarily given up on my little project. No distro can get past GRUB, regardless of whether BIOS compatibility mode is enabled in the UEFI settings. I still suspect video driver problems, but am unable to unearth actual evidence of that yet.

[GreyGeek]

Re: Unbuntu on Windows 8 Developer Preview PC

Then without a doubt my next laptop will be have Linux or WinXP or 7, or be OS free. I will NOT be buying a computer with Win8 installed.