[Bug 1187233] Re: Grub2 fails on ASUS X201E with secure boot is enabled

[Ivan Hu]

It seems,
The shim installs the UEFI protocol in shim.c
EFI_STATUS efi_main (EFI_HANDLE image_handle, EFI_SYSTEM_TABLE *passed_systab)
{
        ...
	shim_lock_interface.Verify = shim_verify;

        ...
	uefi_call_wrapper(BS->InstallProtocolInterface, 4, &handle,
			  &shim_lock_guid, EFI_NATIVE_INTERFACE,
			  &shim_lock_interface);
}

And the grub used the protocol to very the signature, but stopped in the second call.
in grub loader/i386/efi/linux.c
if (shim_lock->verify(data, size) == GRUB_EFI_SUCCESS)
    return 1;
  grub_dprintf ("linuxefi", "Asking shim to verify kernel signature\n");
  status = shim_lock->verify(data, size);
  if (status == GRUB_EFI_SUCCESS)
    {
      grub_dprintf ("linuxefi", "Kernel signature verification passed\n");
      return 1;
    }
 
  grub_dprintf ("linuxefi", "Kernel signature verification failed (0x%lx)\n",
		(unsigned long) status);
   return 0;

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to shim in Ubuntu.
https://bugs.launchpad.net/bugs/1187233

Title:
  Grub2 fails on ASUS X201E with secure boot is enabled

Status in GRand Unified Bootloader:
  New
Status in OEM Priority Project:
  Confirmed
Status in OEM Priority Project precise series:
  New
Status in “shim” package in Ubuntu:
  Confirmed

Bug description:
  Summery:
    I downloaded images from ubuntu.com and use usb-creator-gtk to create bootable usb.
    Then use the usb key to boot on my ASUS X201E laptop and it is always failed to boot to OS.

    These images are all failed:
      ubuntu-12.04.2-desktop-amd64.iso
      ubuntu-12.10-desktop-amd64.iso
      ubuntu-13.04-desktop-amd64.iso

    I also enabled grub2 debug message, and found they all fail on:
      loader/i386/efi/linux.c:69: Asking shim to verify kernel signature.

    The BIOS revision of ASUS X201E is 209 which can be downloaded from
  official ASUS website.

    Additionally, Win8 and Fedora-18 can be booted and installed on this
  platform.

To manage notifications about this bug go to:
https://bugs.launchpad.net/grub/+bug/1187233/+subscriptions