Blue screen when booting from USB drive in UEFI mode (2013.07)

jones · 2013-07-06 14:16:18

SOLUTION for me was to update the firmware on my ASRock mb as thatu pdate changed the EFI software (by American Megatrends) version from 2.00 to 2.31. However, other users are still experiencing the blue screen.

SHORT VERSION
When I try to boot Arch Linux 2013.07 with an USB drive in UEFI mode (for installation), I get a blue screen (which is rather a literal description and not a hint towards the old Windows' one) with the message

Failed to install override security policy (14): Not found

LONG VERSION
I made an USB installation media (product: Intenso Rainbow) by following this advice on the wiki.
I used the july release of Arch for that. First of, after installing the image to the USB stick I found that I needed to correct the label in the archiso-x86_64.conf file to ARCH_201307 (or was it the label of the usb stick, can't remember right now). (Pretty sure it was the same problem with "Linux Live USB Creator" which I used 3-4 months ago...)
After doing that, I rebooted and selected the entry

UEFI Intenso Rainbow

from this list of entries:

SATA HDJ ... something (the hard drive where Win 7 64 bit is installed with all programs)
SATA something (hard drive which only contains data)
Windows Boot Manager
USB: Intenso Rainbow
UEFI: Intenso Rainbow

It went to a blue screen with a message in white text saying

Failed to install override security policy (14): Not found

Below that was an OK button which had a black rectangle over it.
After I experienced the bluescreen, I tried booting the

USB Intenso Rainbow

entry and the boot process then worked fine, I got to that Arch menu where I could choose

Boot Arch Linux (x86_64)
Boot Arch Linux (i686)
Boot existing OS
Run Memtest...
and so on...

But just to make sure, I then did the check for UEFI mode according to this and only saw a folder acpi and ... something else I can't really remember, but it definitely was not efi. Thing is, I needwant to boot into UEFI mode as I have Win 7 already installed in UEFI mode.
Some info about my motherboard: it's from ASRock and is called H67M. The BIOS is dated to 2011-10-26 and is version 1.7.

So far, I only found a mention of the problem here at superuser.com.

Last edited by jones (2013-07-15 07:15:18)

Trilby · 2013-07-06 14:25:47

this also looks related, though I have no idea what it refers to here

If the low level security hook isn’t being registered, there should be a splash error saying “Failed to install override security policy”.

srs5694 · 2013-07-06 14:33:05

I'm the person who posted the reply on SuperUser. I have nothing to add to what I posted there, which I believe explains the nature of the problem, so I'll re-post it here:

The only reference I can find to that error message is in the source code to PreLoader.efi, the Linux Foundation's Secure Boot loader. It indicates that the program was unable to register itself as an extension to the firmware's built-in Secure Boot functions. This error is quite rare. As the developer of rEFInd, I'd be interested in knowing what firmware you've got (make and model of motherboard, as well as the publisher of the firmware and its version number). I also strongly recommend you e-mail Matthew Garrett and James Bottomley; they're the developers of shim and PreLoader, the two Linux Secure Boot solutions released to date. Both are likely to be interested in knowing about this failure, because it affects future directions for their Secure Boot solutions.

It's conceivable that a firmware upgrade would fix this problem, but I can't make any promises about that. If a firmware upgrade doesn't help, I recommend you disable Secure Boot in your firmware. Alternatively, you could try installing using shim rather than PreLoader; shim uses a different method to work around Secure Boot problems. Yet another option is to install your own keys in the firmware, but this procedure is quite tedious. Unless you really want to avoid using Microsoft's keys, this method is likely to be too much effort.

jones · 2013-07-06 15:17:12

Thanks for the answers. Rod, I think I already answered your questions in relation to my motherboard. Your post on superuser was the reason I posted that info actually.

Just for the record: same happened with an USB stick created with Linux Live Creator (after adjusting the stick's label to 'ARCH_201307'). ... what I'm wondering is, what was different (in relation to the issue) with the Arch Linux image file from march?
Hm, can't I just install Linux in "normal" non-UEFI mode and then do something to make it work once I boot into UEFI again?

Last edited by jones (2013-07-06 15:18:44)

jones · 2013-07-06 15:36:23

With an USB installation media created with Linux Live Creator and the 2013.06 Arch Linux version, it still does not work but after selecting
UEFI: Intenso Rainbow
it goes to a screen where 3 entries are shown, the first being Arch (x86_64) and then the two "UEFI shell" entries (v1, v2). After selecting the first entry, it just goes to a black screen.

Last edited by jones (2013-07-06 15:44:21)

srs5694 · 2013-07-06 16:29:00

Chances are you're running PreLoader.efi, since it's very unlikely that anything else would use the exact phrasing "Failed to install override security policy." It might not be stored on your boot media under that filename, though. It sounds like this message isn't causing any real harm, though, since from your description, you're getting to a regular gummiboot menu thereafter. Neither your original post nor your post on SuperUser mentioned an inability to boot beyond that point; but your post #5 in this thread says you're getting a black screen when you select the Arch option. That is the problem, not the PreLoader.efi message. You can remove the PreLoader.efi file, of course (although it's probably stored under another filename), but I doubt if that will do anything but remove that one error message. See my Web page on Secure Boot for more information on PreLoader generally.

As to Arch producing a black screen when booting, there have been similar reports on this forum and elsewhere. Sometimes adding a boot option, like "nomodeset" or "noefi", can fix the problem. (Note that "noefi" disables access to EFI features, though, which means that the efibootmgr utility won't work.) Details vary from one computer to another, though. It's also possible you're running into this problem, which unfortunately isn't really fixed. One workaround is to try another boot loader, though. GRUB usually works, although I've seen recent reports of GRUB problems.

jones · 2013-07-06 16:52:08

Just to make sure: I am not the user who posted on superuser.com. But when I read your answe rthere (superuser.com), I knew it was you from older interactions on this site (archlinux.org).

Thanks for clearing up the black screen problem. Actually, I wouldn't mind sending off 2 mails to the devs about the PreLoader.efi problem but I honestly can't find their addresses (which certainly has a good reason).

Ok, after more research I get that there are some users who played around with boot options for USB sticks... sort of. I can't really pinpoint how to reproduce those steps by working with Win 7 and either win32diskimager or Linux Live USB Creator. I'll guess I give it another try with a Xubuntu usb stick to test things, maybe that'll lead to something. I am not going to use rEFInd as that most likely won't work, tried it out already and didn't get anywhere.

jones · 2013-07-06 17:03:27

Ok, so booting Xubuntu 13.04 in UEFI mode from a USB stick worked flawlessly. It flashed a short message "Secure Boot not enabled" on a black screen and then just loaded up quickly. Although I do not have any possibility to enable Secure Boot (according the motherboard's manual), this reassurance is good.

Don't know what exactly this means and how I could use it, but I'm done with UEFI problems for today. If someone would happen to offer any advice, I'd appreciate it.

Last edited by jones (2013-07-06 17:04:22)

srs5694 · 2013-07-06 18:37:41

Typically, you adjust kernel boot options using your boot manager or boot loader. In GRUB, you hit the "e" key to open an editor. In rEFInd, you hit F2 or Insert twice. I don't recall offhand what key does the job for gummiboot (which I'm pretty sure the Arch installer uses), but I'm certain it's got the feature.

As to contacting Matthew Garrett and James Bottomley, try their blogs:

http://mjg59.dreamwidth.org/
http://blog.hansenpartnership.com/

Also, their e-mail addresses are in their source code:

mjg@redhat.com
James.Bottomley@HansenPartnership.com

That first one (for Garrett) may not be current, though; he switched jobs recently, from Red Hat to a startup called Nebula. I don't think posting the addresses here is a problem since the source code is readily available on the Web and therefore trawlable by spam-bots.

jones · 2013-07-07 09:55:25

Ok then, so this thread has also become about the blank screen problem when booting (in this particular case, Arch 2013.06 since 2013.07 seems to be worse).

srs5694 wrote:

Typically, you adjust kernel boot options using your boot manager or boot loader. In GRUB, you hit the "e" key to open an editor. In rEFInd, you hit F2 or Insert twice. I don't recall offhand what key does the job for gummiboot (which I'm pretty sure the Arch installer uses), but I'm certain it's got the feature.

You are right. Thanks. I realized I had the gummiboot config right in front of me all the time. It's the file 'archiso-x86_64.conf' in \loader\entries (on Windows).
An addendum: I think the USB: Intenso Rainbow boot option takes me into a GRUB menu. Hitting 'e' in this "big" and fully designed menu didn't do anything IIRC. Hitting 'Tab' did the trick to get into editing the boot command line.
Hitting 'e' worked in the gummiboot menu though.

So I tried booting with the following options (also by combining some of them)

nomodeset
acpi_backlight=vendor
radeon.modeset=0 (I have a Gigabyte 7870 card in this desktop machien)
i915.modeset=0

but it did not help.

To be rather safe than sorry: I should mention that there are two grey-ish bars visible on the top and bottom of the screen after I try to boot the first entry, Arch Linux archiso x86_64 UEFI USB. Always has been with those two older Arch version (2013.05+2013.06). I also found another thread where one user talks about using the VGA port of the monitor, which I am currently not, I am using the DVI one, so that's worth a try too. EDIT It did not help either. What I did was setting the primary graphics adapter in the UEFI north bridge configuration menu to 'onboard' which worked immediately when rebooting (I hit the button labeled "Source" on my monitor and it showed it is using the "Analog" mode), but the problem just stayed the same. Adding aforementioned boot options or a combination thereof did not change anything.

Thanks for the e-mail addresses, I sent one to James Bottomley.

Last edited by jones (2013-07-07 11:12:05)

jones · 2013-07-08 10:20:21

Made some more tests, still doesn't work. Here are the tests:

Through a myriad of links in google ... found a thread on ubuntuforums.org where someone had success with switching the SATA mode from IED to AHCI. So I did that aswell.
Tried booting with a live CD instead of USB stick.
Used boot options
```
acpi_osi=linux
radeon.modeset=1
add_efi_memmap
```
and
```
video=SVIDEO-1:d
```
although neither the mainboard nor the graphics card have a s-video connector.

If anybody got anything remotely constructive, I'm happy to hear it.

Last edited by jones (2013-07-09 10:26:59)

jones · 2013-07-09 11:02:41

This is now the last post in this topic, it's not going anywhere without outside help.

Had the idea to boot with a USB live stick into Ubuntu 13.04 and took a look into /var/log:

Went through those, did not really get any hints towards what exactly makes Ubuntu/Xubuntu's USB stick work flawlessly in contrast to Arch's.

johnmurrayvi · 2013-07-09 21:50:44

I figured I'd post here as I just had the same issue. I, like the poster on superuser, have the Sabertoooth 990FX, which doesn't have Secure Boot to my knowledge (at least not the rev 1 that I have).

I'm wondering if any of the previous ISOs have worked, as I'm sure someone has installed Arch on these motherboards before, but the only posts about this problem have been since the 2013.07.01 release.

jones · 2013-07-11 09:35:49

The "solution" for me was to update the motherboard's firmware. As the firmware was updated from 1.70 to 2.10, the EFI version was updated from 2.00 to 2.31. The USB flash drive with 2013.07 now boots flawlessly in UEFI mode (did not try again with 2013.06). However I didn't really do any specific steps to solve any issue possibly directly related to the blue screen or Rod's notations about the PreLoader.efi file.

Last edited by jones (2013-07-15 07:13:57)

KairiTech · 2013-07-14 19:40:05

johnmurrayvi wrote:

I'm wondering if any of the previous ISOs have worked, ...

I have an ASUS mobo too (M5A99X EVO Rev. 1) flashed with the latest BIOS and the archlinux-2013.07.01-dual.iso image copied to a USB drive results in the Failed to install override security policy (14): Not found blue screen.

The archlinux-2013.06.01-dual.iso image boots as expected with no issues.

jones · 2013-07-15 07:12:36

Removed [SOLVED] tag due to KairiTech's and johnmurrayvi's posts.
Amended my "solution" in the op to indicate that I sort of managed to overcome the problem but I didn't really solve it.

Last edited by jones (2013-08-03 06:40:19)

KairiTech · 2013-08-02 14:04:47

I get the blue screen with the archlinux-2013.08.01-dual.iso release as well.

Thinking I just need to resign myself to getting a new mobo. The last BIOS update 1708 was issued on 2013.05.10.

[EDIT] See here for a solution that worked for my ASUS M5A99X EVO.

Thus, you can safely bypass the PreLoader program: Mount the USB flash drive's ESP and copy EFI/BOOT/loader.efi to EFI/BOOT/bootx64.efi, overwriting the original file.

Last edited by KairiTech (2013-09-07 11:08:21)

Arch Linux

#1 2013-07-06 14:16:18

Blue screen when booting from USB drive in UEFI mode (2013.07)

#2 2013-07-06 14:25:47

Re: Blue screen when booting from USB drive in UEFI mode (2013.07)

#3 2013-07-06 14:33:05

Re: Blue screen when booting from USB drive in UEFI mode (2013.07)

#4 2013-07-06 15:17:12

Re: Blue screen when booting from USB drive in UEFI mode (2013.07)

#5 2013-07-06 15:36:23

Re: Blue screen when booting from USB drive in UEFI mode (2013.07)

#6 2013-07-06 16:29:00

Re: Blue screen when booting from USB drive in UEFI mode (2013.07)

#7 2013-07-06 16:52:08

Re: Blue screen when booting from USB drive in UEFI mode (2013.07)

#8 2013-07-06 17:03:27

Re: Blue screen when booting from USB drive in UEFI mode (2013.07)

#9 2013-07-06 18:37:41

Re: Blue screen when booting from USB drive in UEFI mode (2013.07)

#10 2013-07-07 09:55:25

Re: Blue screen when booting from USB drive in UEFI mode (2013.07)

#11 2013-07-08 10:20:21

Re: Blue screen when booting from USB drive in UEFI mode (2013.07)

#12 2013-07-09 11:02:41

Re: Blue screen when booting from USB drive in UEFI mode (2013.07)

#13 2013-07-09 21:50:44

Re: Blue screen when booting from USB drive in UEFI mode (2013.07)

#14 2013-07-11 09:35:49

Re: Blue screen when booting from USB drive in UEFI mode (2013.07)

#15 2013-07-14 19:40:05

Re: Blue screen when booting from USB drive in UEFI mode (2013.07)

#16 2013-07-15 07:12:36

Re: Blue screen when booting from USB drive in UEFI mode (2013.07)

#17 2013-08-02 14:04:47

Re: Blue screen when booting from USB drive in UEFI mode (2013.07)

Board footer