Windows with bitlocker enabled can't be booted, needs to use bootnext instead of chainloader #13

New issue

Open

opened 2024-09-30 17:46:07 +00:00 by humaton · 0 comments

humaton commented

2024-09-30 17:46:07 +00:00

Member

Description of problem: Currently grub.cfg contains: chainloader /EFI/Microsoft/Boot/bootmgfw.efi This won't work with recent Windows 10 systems with TPM 2.0, which now default to Bitlocker being enabled out of the box with the disk encryption key sealed in the TPM. As a result of shim->grub->chainloader, the TPM measurements have changed and therefore the bitlocker key won't be unsealed by the TPM, resulting in a Windows recovery boot asking for the bitlocker encryption passcode. Version-Release number of selected component (if applicable): grub2-2.06-14.fc36 How reproducible: Always Steps to Reproduce: 1. Computer with TPM 2.0 and a default clean installation of Windows 10 or 11 (I did this on a Lenovo ThinkPad X1 Carbon Gen 7 laptop; blkdiscard the entire NVMe drive; clean installed Windows from an ISO downloaded from microsoft.com about 9 months ago, and it enabled bitlocker encryption by default) 2. Do a default Fedora installation (resize Windows partition to create enough free space for Fedora) 3. In the GRUB menu, select Windows Boot Manager Actual results: I see a Bitlocker Recovery screen requesting entry of a recovery key. Boot will not proceed without it. Expected results: Instead of chainloading the Windows bootloader from GRUB, GRUB needs to set BootNext in NVRAM followed by system reset. That way the firmware does a one time boot of the Windows bootloader directly (without shim or grub), resulting in valid TPM measurements unsealing the bitlocker key, and a seamless boot of Windows. Additional info: See also bug 1700397 and bug 1426328.