Arch Linux

miguel375

Member

Registered: 2024-07-12

Posts: 18

System "not booted in UEFI mode" in Setup mode (secure boot setup)

I'm trying to setup secure boot on my laptop (Lenovo Yoga Slim 7i, Intel Core Ultra Lunar Lake) using sbctl.

If I run "sbctl status" when secure boot is off and not in setup mode, it correctly reports that the system is booted in UEFI mode. However, when I reboot and enter setup mode, sbctl now claims the system is not booted into UEFI mode at all, and I cannot continue the process.
This likely isn't an issue with sbctl specifically, because bootctl/systemd also report the same, so I'm assuming it's a firmware issue. I've already updated the firmware to the latest version.

Has anyone had luck setting up secure boot in these or similar laptops?

-thc

Member

Registered: 2017-03-15

Posts: 1,176

Re: System "not booted in UEFI mode" in Setup mode (secure boot setup)

AFAIK the "setup mode" for "Secure Boot" is only entered to replace the "Platform Key" (PK).
As soon as the new PK is in place the system is in "User mode".

Some UEFI firmware implementations allow the exchange of the PK only inside the EFI setup itself - do you have such an option?

miguel375

Member

Registered: 2024-07-12

Posts: 18

Re: System "not booted in UEFI mode" in Setup mode (secure boot setup)

AFAIK the "setup mode" for "Secure Boot" is only entered to replace the "Platform Key" (PK).
As soon as the new PK is in place the system is in "User mode".

Some UEFI firmware implementations allow the exchange of the PK only inside the EFI setup itself - do you have such an option?

There's no option for setting a key in the UEFI settings unfortunately, so there's no way for me to change the PK.
The only secure boot related options I have are for toggling secure boot, resetting the keys, entering setup mode and toggling 3rd party keys (which I've tried).

-thc

Member

Registered: 2017-03-15

Posts: 1,176

Re: System "not booted in UEFI mode" in Setup mode (secure boot setup)

Unfortunately my preferred way of changing keys (via EFI firmware built-in EFI shell and the "efitools" binary "KeyTool.efi") no longer works out of the box - the maintainers have removed the ".efi" binaries from the "efitools" package.

You can however extract it from the older efitools package (1.9.2-5) via the Arch archive (https://archive.archlinux.org/packages/e/efitools/) - but I never tried if it still works.

miguel375

Member

Registered: 2024-07-12

Posts: 18

Re: System "not booted in UEFI mode" in Setup mode (secure boot setup)

Unfortunately my preferred way of changing keys (via EFI firmware built-in EFI shell and the "efitools" binary "KeyTool.efi") no longer works out of the box - the maintainers have removed the ".efi" binaries from the "efitools" package.

You can however extract it from the older efitools package (1.9.2-5) via the Arch archive (https://archive.archlinux.org/packages/e/efitools/) - but I never tried if it still works.

Booting into KeyTool.efi in setup mode shows "Setup mode enabled" at the top and I have the option to replace the keys, so it might work. I've never set up secure boot manually though, I'll have to look into it.