EFI and Linux: the future is here, and it's awful.

[GreyGeek]

first off its "UEFI".

That's what I wrote.

secondly there is nothing wrong with UEFI itself.

Since you obviously haven't watched the video allow me to present the introductory summary:

Matthew Garrett is the one at Red Hat that's been working quite extensively on UEFI support under Linux, since this BIOS successor is beginning to be found in all new hardware. He's the one that's been shouting how UEFI Secure Boot will cause big problems for Linux. He's also worked on matters like better reboot support and finally fixing the ASPM Linux kernel power regression.

While Secure Boot is what's usually brought up when mentioning Linux and UEFI in the same sentence, there's much more to this new architecture than just a locked-down boot process in an attempt for greater security. UEFI does provide some good like better variable storage, no longer needing to pound out Assembly, greater device capabilities and more. But besides Secure Boot being a major pain for Linux and other non-Windows operating systems, another big problem with UEFI has been all of the bugs uncovered in different hardware devices.

While everyone else has been talking, spinning and pontificating, Matthew has been working for RH trying to solve the code problems UEFI brings to Linux. It is HIS experience that led him to the conclusion that the EUFI code is BIG, BUGGY, and NEVER BEEN TESTED. No one else that I know of has been working with the UEFI code to clear up the question as to whether Linux will work with UEFI or not. So far, Linux is able to work on PCs that allow UEFI to be disabled, or comes with UEFI disabled. I pointed out the information at and after the 45 minute mark just to save folks the time watching the video. The first 18 minutes are cursory stuff, with hot info coming at 18:33, and again at 33:33.

on top of that we really do need a replacement for BIOS. personally i am in favor of coreboot. oh btw openbios iirc turned into coreboot or they merged. i have one of these as the main board in my server. the UEFI has given me no problems installing a linux distro on it. the problem is that M$ thinks they can dictate to hardware manufactures how to make their boards. If M$ dictates they force key signing and don't let users put their own keys have it enabled by the default (etc..) this is indeed very bad.

The use of these keys is not in themselves bad, as long as its user modifable.Prehaps all machines with UEFI (including those that come prebuilt) should come with a disk(or better yet built in utility) you can to run to install your os's keys from a list. if your keys are not on a list provide a user with a manual where they can provide their own key via a usb stick or net address (after all its UEFI so all the hw will be working). i realise that this is might not be the most realistic case but i think it would be a case that would at least make everyone happy. unless intel jumps on the support coreboot bandwagon then we might get that.

Matthew points out that the OEM vendors may give a PK to, say, Ubuntu, but that doesn't mean that drivers written by others can be certified by it. It also means that Linux Mint may not be able to get certified unless the OEM gives them a key as well. Also, don't forget the BIGGEST problem of all: Ubuntu (for example) would have to get a PK from EVERY PC OEM that it wants Ubuntu to boot on, and for every model. Getting a PK from DELL for Inspiron Laptops won't help Ubuntu boot on an ASUS laptop.

In addition, as I pointed out previously, EVERY Kernel module would have to have a PK certificate from the peripheral device that module drives, and for the PC on which that device is installed. The UEFI whitelist would get gigantic. And, the UEFI code is so buggy and untested that there is no guarantee that the UEFI would be stable under those circumstances.

It is a very informative talk by one of the FEW, if not the only, Linux guys to ACTUALLY work with the EUFI code. What anyone else says is just second hand knowledge, wild speculation, or blatent spinning.

[sithlord48]

first off its "UEFI". secondly there is nothing wrong with UEFI itself.on top of that we really do need a replacement for BIOS. personally i am in favor of coreboot. oh btw openbios iirc turned into coreboot or they merged. i have one of these as the main board in my server. the UEFI has given me no problems installing a linux distro on it. the problem is that M$ thinks they can dictate to hardware manufactures how to make their boards. If M$ dictates they force key signing and don't let users put their own keys have it enabled by the default (etc..) this is indeed very bad.

The use of these keys is not in themselves bad, as long as its user modifable.Prehaps all machines with UEFI (including those that come prebuilt) should come with a disk(or better yet built in utility) you can to run to install your os's keys from a list. if your keys are not on a list provide a user with a manual where they can provide their own key via a usb stick or net address (after all its UEFI so all the hw will be working). i realise that this is might not be the most realistic case but i think it would be a case that would at least make everyone happy. unless intel jumps on the support coreboot bandwagon then we might get that.

[Detonate]

One of the things I have never done as a computer repair person, is to stock MBs. Until now, I always considered it unnecessary as I can get a new MB from any online source with overnight shipping and have the computer repaired quickly. That way I could always get an up to date MB. I would not want to use a MB that has been sitting in my storage for a year or so. However, I am now considering that I may have to change my policy on this.

[woodsmoke]

oh i don't know Aardvark.

Everyone that knows me agrees that I'm not that bright and if I could figure it out they probably could if they were "en extremis" as it were!

woodsmoke

[ardvark71]

Hi GreyGeek...

Thank you for your comments. I hope the list of supported hardware grows. Not much there. :-(

[GreyGeek]

If not rolled back, then a EUFI that is friendly to all OS's. If not, then perhaps and OEM can be found that will produce a EUFI free board. But what about the other companies who make the graphics, networking, sound and other chipsets who stand to lose the free advertising?

EDIT: I just saw lo_koraco's post which changes some things. I didn't watch the whole video so I missed the part about EUFI being disabled on x86 systems. However, how much longer before 32 bit is phased out entirely?

Regards...

The video pointed out that the EUFI code is under the BSD license, that even though there are "a couple" versions, most vendors are downloading the Intel version. Anyone can download the 100MB plus of EUFI source code if they want to. It's the proprietary parts that drive the hardware which are not accessible. Intel's version, Tianocore, is available from here.

I agree that it is time to create a reasonable BIOS built for 64 bit operating systems, but EUFI is not the one. There is no need for a "BIOS" that generates an executable that is 10 times bigger than the Linux kernel if drivers are included.

We have some already available:
CoreBoot, formerly known as LinuxBIOS, which can boot directly to GRUB. AMD has added support for CoreBoot, along with GL 1.4. A video describing getting CoreBoot to work is here:

OpenBIOS appears to be abandon, since the last work was when V1.0 wss released.

All the other BIOS projects have evaporated.

[ardvark71]

If this actually goes through I would highly recommend that all Linux users do a couple of things if they have a "tower".
Then, one a day when you are not working...get a beverage of your choice and a flashlight..... remove the side of the computer(with it turned off ) and start looking at the insides of it because, eventually, you may HAVE to put the new mobo in if you can't find a repair person who will work on something other than microsith computers.

Hi Woodsmoke...

I wouldn't advise this as something just anyone can do. You have to know what you're doing, despite the "do-it-yourself" sites. I've seen examples of folks trying to fix their computers without the proper knowledge (and suffering from the results) first hand in the course of my work. ;-)

Regards...

[ardvark71]

Maybe, by then, we can muster legal help in getting the EUFI rolled back, or get an open source mobo produced.

If not rolled back, then a EUFI that is friendly to all OS's. If not, then perhaps and OEM can be found that will produce a EUFI free board. But what about the other companies who make the graphics, networking, sound and other chipsets who stand to lose the free advertising?

EDIT: I just saw lo_koraco's post which changes some things. I didn't watch the whole video so I missed the part about EUFI being disabled on x86 systems. However, how much longer before 32 bit is phased out entirely?

Regards...

[woodsmoke]

If this actually goes through I would highly recommend that all Linux users do a couple of things if they have a "tower".

a) go to your nearby computer repair store and purchase maybe two motherboards that will fit the machine and put them in storage.
b) purchase a coupld of smaller hard drives, or conversely larger, depending on which is cheapest and put them in storage.
c) purchase a couple of the largest usb sticks one can purchase, or multiple small ones, to use as storage and put them away in storage.
d) purchase an "enclosure" for an external "drive" and again, get a couple of smaller drives, or one big for external storage.
e) purchase two extra memory sticks of at least one gig each. One gig will run any Linux although it may not run a bunch of eyecandy which may need to be turned off so one can keep one's favourite distro.
f) purchase a couple of second hand or maybe new, dvdrw devices.
g) purchase at least two cables that you use to connect the drives to the mobo.

Then, one a day when you are not working...get a beverage of your choice and a flashlight..... remove the side of the computer(with it turned off ) and start looking at the insides of it because, eventually, you may HAVE to put the new mobo in if you can't find a repair person who will work on something other than microsith computers.

I will never forget the day that a Microsith troll appeared in the Johnnieman's shop, I happened to be there helping to hold up a shelf of parts for the privilege of watching him rebuild computers with one hand while playing video games with the other ... and the guy demanded, legally, to see all of the Microsith liscences in the office and that he boot up, I think, ten, of the loose hard drives that he chose.

The Johniieman was legal, but Microsith does this all the time.

woodsmoke

Basically, get your new computer before EUFI became the default firmware if you want to run Linux. A new computer should last 3 or 4 years. Maybe, by then, we can muster legal help in getting the EUFI rolled back, or get an open source mobo produced. I believe that EUFI will make computers less than 5 years old that don't have EUFI sell at premium prices.

The Microsoft requirements state that secure boot on x86 systems must be possible to disable and that it must be possible to sign your own keys. The signing your own keys is troublesome, as Garrett explains, but disabling secure boot will be easy, though not standardized. As for the rest of the UEFI spec and how it will affect the systems, I'd second your suggestion to avoid systems of the sort, simply due to the huge number of bugs this will bring into the fold once all the HW combos start rolling out.

[DoYouKubuntu]

I'm baffled. How on earth is it POSSIBLE for micro$oft to do something like this? They are NOT the god of computing, regardless of how much they may THINK they are.

[GreyGeek]

The good points of the talk start at 18:33, 33:00 and 45:00.
Basically, the EUFI is NOT DRM, and there is no guarantee of a secure boot. The EUFI code is massive, UNTESTED and BUGGY. The part that checks signed modules was written by Microsoft and all functions begin with "win_". It is basically designed, as we suspected, to block Linux. All hardware drivers, kernel, kernel modules, etc., would have to be signed by the PK (Platform Key -- the hardware vendor) to get our drivers into the whitelist. IF the hardware vendors do that then they risk losing the free advertizing by Microsoft.

Bssically, at 41:30, we learn that those who can change firmware all will be OK, but the days of taking a LiveCD and booting it and installing Kubuntu are over.

Basically, get your new computer before EUFI became the default firmware if you want to run Linux. A new computer should last 3 or 4 years. Maybe, by then, we can muster legal help in getting the EUFI rolled back, or get an open source mobo produced. I believe that EUFI will make computers less than 5 years old that don't have EUFI sell at premium prices.