secureboot

When installing Linux Mint came across a note about Secureboot. This page contains some information collated at that time.

EFI partition

Highlight the EFI System Partition (usually a 200-550MB partition formatted FAT32) that Windows already created on the system and click “Change”. Make sure it’s set to EFI System Partition, (or EFI boot partition, or /boot/efi) – leave the size and formatting alone (do not change them). Here is a screenshot example of what you should see (your partition size may be different):

VERY IMPORTANT STEP!!! Near bottom of window, “Device for bootloader installation” should be the EFI System Partition. Select that one in the drop-down box. It will be a small (200-550MB) partition formatted as FAT32. It will likely be /dev/sda1 or /dev/sda2; but double-check that to be sure.

The first was with EFI boot disabled in BIOS (a.k.a. Legacy or CSM mode, depending on manufacturer). When I ran the installer and chose the “Something Else” option, clicked on the EFI partition, then clicked Change, I found the same thing Tropz17 is talking about - you cannot set the mount point as EFI boot, because it is not included in the menu. Also, the format box is enabled.

After rebooting and setting EFI boot as enabled in BIOS, and running the installer, the dialogue box automatically shows EFI boot when you click on the EFI partition, and it does not allow you to change it. Also, the format box is greyed out, or in other words, disabled. So the installer does detect whether you are booting with EFI enabled or disabled in BIOS.

Tropz17, I would be careful here, you do not want to brick your machine. I see you are aware of the problems people are having with Samsung products concerning EFI and Secure Boot. It might be wise to create a recovery USB stick for Windows if you have not done so already. That way if things go bad, you can re-install Windows. Most manufacturers have installed software that allows you to do this. After doing so, you may want to consider wiping Windows from the drive entirely, disabling Secure Boot, enabling CSM mode, and installing Linux Mint as a stand alone operating system. I think it would be a good idea to do some extensive googling first to see if other people have tried this approach and what the outcome is.

https://forum.gigabyte.us/thread/1706/find-secure-boot-gigabyte-ab350m ↗

To make the option visible go in Bios -> classic mode->BIOS - Windows 10 features ->disable csm.

Then you will see a secure boot option is avaiable as the last point.

Csm lets you use non uefi devices and therefore it disables secure boot.

Was actually more by try and error that i found it just now but thats how things go sometimes.

https://forum.gigabyte.us/thread/5472/switch-uefi-legacy-boot ↗

“Under the Bios Features tab enable CSM and then do UEFI and LEGACY setting…set the boot legacy first and you should be able to get into the drive to run it…another option is to boot the drive as a virtual drive using third party software

Posted by firewolfrl”

https://forum.gigabyte.us/thread/6997/gigabyte-b450m-ds3h-disable-secure ↗

Yes. enabling csm automatically disables secure boot, and it should remove the option for secure boot from the bios in order to avoid any confusion about whether it is available and working. when you disable csm the option will be available on the same screen, but at the bottom of the screen.

I’ve an issue with disabling CSM on a Gigabyte B450 I Aorus Pro WIFI (Bios V. F50). Everytime I disable CSM a message pops ups telling me to disable CSM in Setup (which I did) and repeat operation after reboot and ensure Uefi video driver (gop) is operational. But when I saved settings and rebooted, my monitor stayed blacked for a few seconds and booted normally into windows 10. To check whether CSM was disabled i rebooted again and it was enabled again. I also tried to reset settings to default, clearing CMOS via Jumper method and I flashed an new VBIOS with UEFI signature on rx 570 but there is still no effect. Why does this board keep enabling CSM?

I think that’s the answer I needed: just set up for Window10 and standard keys secure boot and I should be good to go…thanks.