Di-live support for UEFI install

[JedMeister]

Now that we've rebased our live ISO functionality on default Debian tools (i.e. live-tools & live-boot) and di-live is using default Debian d-i source code, suport for UEFI systems shouldn't be too hard...

[JedMeister]

I just realised that this is a duplicate of #932, but I'm going to close that in favour of this one.

I briefly had a look at this and I think it should be pretty easy to support UEFI (we'll need to include the d-i source for partman-efi and also include grub-efi package. What I think what might be a little tricky though, is support for both legacy BIOS and UEFI!

Having said that, it seems like it should be possible. Here are a few links which might help:

• https://wiki.debian.org/UEFI
• https://superuser.com/questions/801515/is-a-hybrid-linux-usb-stick-for-uefi-legacy-bios-possible
• https://linuxconfig.org/legacy-bios-uefi-and-secureboot-ready-ubuntu-live-image-customization
• https://www.0xf8.org/2020/03/recreating-isos-that-boot-from-both-dvd-and-mass-storage-such-as-usb-sticks-and-in-both-legacy-bios-and-uefi-environments/
• https://wiki.syslinux.org/wiki/index.php?title=Isohybrid

[JedMeister]

I had hoped to implement this in v17.0, but we've run out of time...

Having said that, I have got the ISO UEFI boot part sorted - see the cdroots uefi-boot branch and this fab PR (which undid the working UEFI boot supporting ISO creation process).

I did do some work on di-live too, but that was never completed. The outstanding work can be found in this PR.

[derMart]

In order to get bitkey working again I also needed uefi live "cd" boot.
Checked out uefi-boot branch in tkldev cdroots and patched product.mk to use run-genisoimage-uefi instead of run-genisoimage. This worked fine and got an iso image created which I dd'ed onto a usb stick.
Tested those on a few machines and can report some positive feeback: Working on an older Intel Desktop with UEFI boot mode enabled as well as disabled. Worked on a rather new Dell XPS 13 with UEFI boot enabled, and also worked on an old Dell laptop without UEFI capabilities.

Where it didn't work, but where I wanted it most, was a Surface Pro 3 Laptop which only has UEFI boot mode (thanks alot microsoft ;-) ). The usb stick just did not boot. So I thought I'd do the most basic and try to produce a simple UEFI only usb stick for testing on the Surface. So I created a gpt partition table, a fat32 partition and tagged this as EFI system partition in fdisk. Then, I copied boot, isolinux (most probably not necessary) and live directory (where kernel and rootfs is) from the generated hybrid iso onto the stick.

First idea was to use the bootx64.efi from here and copy that into the default efi binary path /efi/boot/bootx64.efi onto the stick. That resulted in some unknown filesystem errors. I guess the gpt partition and fat modules are not in there. So my next steps in this direction would probably be to regenerate them via grub-mkrescue as adviced in the uefi-boot branch readme and add some more grub modules.

However, second idea was to directly use grub-mkimage as advised here: https://askubuntu.com/questions/395879/how-to-create-uefi-only-bootable-usb-live-media/395880#395880
I just changed the prefix path (where grubs additional files will reside on the target partition) to match the iso:

sudo grub-mkimage -o bootx64.efi -p /boot/grub -O x86_64-efi  fat iso9660 part_gpt part_msdos normal boot linux configfile loopback chain efifwsetup efi_gop efi_uga ls search search_label search_fs_uuid search_fs_file  gfxterm gfxterm_background gfxterm_menu test all_video loadenv  exfat ext2 ntfs btrfs hfsplus udf

This probably has more modules inside than needed, but that does not matter.
I got it to boot into the correct turnkey grub menu screen, so I was sure that /boot/grub/grub.cfg was loaded. But when selecting the "boot from live image / tryout" option I got this:

Loading Linux ...
error: symbol `grub_efi_secure_boot' not found.

looking at the grub.cfg I might try to add insmod part_gpt, but I am not sure if this is the problem. I also tried to look for the string "grub_efi_secure_boot" inside the grub source code tree but it wasn't found, which leaves me a bit puzzled. If anyone knows the root cause of this error message, I would be very interested...

so far, I will try to update here if I got more results.

[JedMeister]

Nice work @derMart! 😄 It sounds like you've had some good progress.

One thing, is it possible to disable secure boot on the Surface? (It wouldn't surprise me if it wasn't but perhaps double check? If your UEFI stuff is working elsewhere, then my guess is that it's choking on secure boot).

And if it is choking on secure boot, then you'll need to boot from a boot loader that is signed by a key that is acceptable to the UEFI - we don't have such a key so can't help you there. I suggest starting with a Debian Live ISO and see how that goes. If that boots ok, then perhaps you can hack on that to chainload BitKey?