EDIT by @StollD:
The TL;DR; of this issue: After a recent firmware update, enrolling secureboot certificates causes the device to freeze on the Microsoft logo.
The new firmware ships with a security feature called NX mode. It means that the firmware will not allocate memory that is readable, writable and executable by default. Applications can set a flag in their binary during compilation to indicate whether they are compatible with NX mode, and the UEFI should only turn it on when the applications indicate compatibility.
Unfortunately, Microsoft decided to ignore this flag and are always enabling NX mode.
When you enroll a certificate, a flag in the UEFI variable storage is set that will cause the Shim bootloader to launch a program called "MokManager". Unfortunately, this program is currently incompatible with NX mode, and will cause the firmware to stop executing it right after getting loaded.
Furthermore, when you try to boot an installation image in this state, it is possible that the shim bootloader will abort with an error. This is because it sees the UEFI variable and tries to launch MokManager, but some installation images are not shipping with MokManager.
The good news is: This issue is fixed on the shim main branch, so once the distributions update their shim, this issue should disappear. The bad news is, that it is not possible for us to fix this, since we can't get a signed shim / MokManager from Microsoft.
For now there are three possible solutions:
- Disable secureboot and don't enroll any certificates. This is certainly the easiest.
- There is a Linux Mint installation image (21.2) that contains a working MokManager. When you are trapped in the bugged state, you can use this to finish the enrollment process. After the certificate is enrolled, you should be able to boot normally.
- Downgrading the firmware.
Some additional notes (IMPORTANT):
Since this issue can be fixed by booting the Mint image once or by disabling secureboot, I would recommend against downgrading the firmware, unless you absolutely want to or you know what you are doing. Feel free to ask for assistance with the process in our support channel on Matrix: https://matrix.to/#/#linux-surface-support:matrix.org
Original post:
After install I get no boot. Locked up on the Microsoft logo
EDIT by @StollD:
The TL;DR; of this issue: After a recent firmware update, enrolling secureboot certificates causes the device to freeze on the Microsoft logo.
The new firmware ships with a security feature called NX mode. It means that the firmware will not allocate memory that is readable, writable and executable by default. Applications can set a flag in their binary during compilation to indicate whether they are compatible with NX mode, and the UEFI should only turn it on when the applications indicate compatibility.
Unfortunately, Microsoft decided to ignore this flag and are always enabling NX mode.
When you enroll a certificate, a flag in the UEFI variable storage is set that will cause the Shim bootloader to launch a program called "MokManager". Unfortunately, this program is currently incompatible with NX mode, and will cause the firmware to stop executing it right after getting loaded.
Furthermore, when you try to boot an installation image in this state, it is possible that the shim bootloader will abort with an error. This is because it sees the UEFI variable and tries to launch MokManager, but some installation images are not shipping with MokManager.
The good news is: This issue is fixed on the shim main branch, so once the distributions update their shim, this issue should disappear. The bad news is, that it is not possible for us to fix this, since we can't get a signed shim / MokManager from Microsoft.
For now there are three possible solutions:
Some additional notes (IMPORTANT):
Since this issue can be fixed by booting the Mint image once or by disabling secureboot, I would recommend against downgrading the firmware, unless you absolutely want to or you know what you are doing. Feel free to ask for assistance with the process in our support channel on Matrix: https://matrix.to/#/#linux-surface-support:matrix.org
Original post:
After install I get no boot. Locked up on the Microsoft logo