Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 2049849 - Windows with bitlocker enabled can't be booted, needs to use bootnext instead of chainloader
Summary: Windows with bitlocker enabled can't be booted, needs to use bootnext instead...
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: grub2
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Nicolas Frayer
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: https://ask.fedoraproject.org/t/20612...
Depends On:
Blocks: 2132134
TreeView+ depends on / blocked
 
Reported: 2022-02-02 19:27 UTC by Chris Murphy
Modified: 2024-03-24 17:48 UTC (History)
23 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 2132134 (view as bug list)
Environment:
Last Closed:
Type: Bug
Embargoed:
bcotton: fedora_prioritized_bug+

Attachments (Terms of Use)

Description Chris Murphy 2022-02-02 19:27:24 UTC 
Description of problem:

Currently grub.cfg contains:
	chainloader /EFI/Microsoft/Boot/bootmgfw.efi

This won't work with recent Windows 10 systems with TPM 2.0, which now default to Bitlocker being enabled out of the box with the disk encryption key sealed in the TPM. As a result of shim->grub->chainloader, the TPM measurements have changed and therefore the bitlocker key won't be unsealed by the TPM, resulting in a Windows recovery boot asking for the bitlocker encryption passcode.


Version-Release number of selected component (if applicable):
grub2-2.06-14.fc36


How reproducible:
Always


Steps to Reproduce:
1. Computer with TPM 2.0 and a default clean installation of Windows 10 or 11 (I did this on a Lenovo ThinkPad X1 Carbon Gen 7 laptop; blkdiscard the entire NVMe drive; clean installed Windows from an ISO downloaded from microsoft.com about 9 months ago, and it enabled bitlocker encryption by default)
2. Do a default Fedora installation (resize Windows partition to create enough free space for Fedora)
3. In the GRUB menu, select Windows Boot Manager

Actual results:

I see a Bitlocker Recovery screen requesting entry of a recovery key. Boot will not proceed without it.


Expected results:

Instead of chainloading the Windows bootloader from GRUB, GRUB needs to set BootNext in NVRAM followed by system reset. That way the firmware does a one time boot of the Windows bootloader directly (without shim or grub), resulting in valid TPM measurements unsealing the bitlocker key, and a seamless boot of Windows.


Additional info:


See also bug 1700397 and bug 1426328.
Comment 1 Fedora Blocker Bugs Application 2022-02-02 19:38:56 UTC 
Proposed as a Blocker for 36-final by Fedora user chrismurphy using the blocker tracking app because:

 https://fedoraproject.org/wiki/Fedora_35_Final_Release_Criteria#Windows_dual_boot

"and install a bootloader which can boot into ... Windows"

The intent of the criterion is that Windows is bootable, which it isn't. In that sense, the bug is a blocker.

However, this isn't a bug per se, nor is it a regression in GRUB. TPM measured boot is working as designed. This is in effect a request for enhancement for GRUB. From this point of view, it's maybe not a blocker because the criterion itself is prescribing a solution that won't work.

The current work around is to use the firmware's boot manager to choose to boot Windows.

This is probably a good candidate for common bugs documentation, and as a prioritized bug though.
Comment 2 Geoffrey Marr 2022-02-07 21:03:00 UTC 
Discussed during the 2022-02-07 blocker review meeting: [0]

The decision to classify this bug as an "AcceptedBlocker (Final)" was made as it violates the following criterion:

"The installer must be able to install into free space alongside an existing clean Windows installation and install a bootloader which can boot into both Windows and Fedora" in the case of Windows being installed with Bitlocker enabled (as is increasingly common).

We recognize this is technically difficult to fix and may change or defer.

[0] https://meetbot.fedoraproject.org/fedora-blocker-review/2022-02-07/f36-blocker-review.2022-02-07-17.00.txt
Comment 3 Robbie Harwood 2022-02-07 21:50:23 UTC 
> The current work around is to use the firmware's boot manager to choose to boot Windows.

One can manipulate this from Linux using efibootmgr to set BootNext to the Windows entry as well.

I recommend either changing the criteria or deferring.
Comment 4 Chris Murphy 2022-02-08 00:05:22 UTC 
See also:
https://pagure.io/fedora-workstation/issue/278
https://lists.gnu.org/archive/html/grub-devel/2022-02/msg00073.html
Comment 5 Ben Cotton 2022-02-08 20:07:12 UTC 
This bug appears to have been reported against 'rawhide' during the Fedora 36 development cycle.
Changing version to 36.
Comment 6 Zbigniew Jędrzejewski-Szmek 2022-02-10 07:46:26 UTC 
For sd-boot we solved it by using BootNext [1]. That code will be available in rawhide
after the next release (~one or two weeks). It's reported to work, though I haven't
tried it myself due to lack of appropriate wall fixtures.

[1] https://github.com/systemd/systemd/pull/22043/commits/661615a0afacee3545cde0a48286c0fef983f8fe
Comment 7 Adam Williamson 2022-03-29 19:01:40 UTC 
At the 2022-03-28 blocker review meeting, we agreed to waive this bug to Fedora 37 according to the process:

https://fedoraproject.org/wiki/QA:SOP_blocker_bug_process#Exceptional_cases
https://meetbot-raw.fedoraproject.org/fedora-blocker-review/2022-03-28/f36-blocker-review.2022-03-28-16.00.html
https://meetbot-raw.fedoraproject.org/fedora-blocker-review/2022-03-28/f36-blocker-review.2022-03-28-16.00.log.html

This is considered a "difficult to fix" bug - as indicated by Robbie above, there is no realistic prospect of it being fixed during the Fedora 36 timeframe.

Accordingly, it is waived to Fedora 37. If upstream still doesn't consider this addressable during that timeframe, we'll consider amending the release criteria to not require dual-boot to work with BitLocker-enabled Windows installs.
Comment 8 Ben Cotton 2022-08-09 13:12:40 UTC 
This bug appears to have been reported against 'rawhide' during the Fedora Linux 37 development cycle.
Changing version to 37.
Comment 9 Adam Williamson 2022-09-19 19:17:38 UTC 
Since this doesn't seem to be moving, here's a release criteria amendment proposal: https://lists.fedoraproject.org/archives/list/test@lists.fedoraproject.org/message/YT24WA7W6HYHOENBKDJ66PMZ4CHBTBMM/
Comment 10 Adam Williamson 2022-09-30 16:31:27 UTC 
The criterion proposal was approved and implemented, so bumping this back to proposed blocker. I expect it should now be rejected, since the criterion specifically exempts this exact situation.
Comment 11 František Zatloukal 2022-10-03 17:23:29 UTC 
Discussed during the 2022-10-03 blocker review meeting: [1]

The decision to classify this bug as an RejectedBlocker was made:

We reject this as a blocker per the rewritten criterion: "The installer must be able to install into free space alongside an existing clean Windows installation. As long as the Windows installation does not have BitLocker enabled, the installer must also install a bootloader which can boot into both Windows and Fedora."

[1] https://meetbot-raw.fedoraproject.org/fedora-blocker-review/2022-10-03/f37-blocker-review.2022-10-03-16.00.log.txt
Comment 12 Fedora Admin user for bugzilla script actions 2023-02-02 00:13:25 UTC 
This package has changed maintainer in Fedora. Reassigning to the new maintainer of this component.
Comment 13 James Heather 2023-03-28 08:04:19 UTC 
Is there any progress here? It's such a shame if Fedora can't play nicely with modern Windows installations: it'll really put people off making the switch.
Comment 14 Bas Mevissen 2023-04-02 15:27:05 UTC 
I only use grub as bootloader. When grub gets updated, I need to key in the bitlocker key once. Afterwards, it is fine. I can boot Fedora or Windows 11 fine from grub with secure boot enabled and bitlocker on.
Comment 15 Kamil Páral 2023-04-05 07:02:59 UTC 
Proposing as a Prioritized bug as mentioned in comment 1. This is a long-standing bad situation for our dual-boot users.
Comment 16 Ben Cotton 2023-04-19 14:55:41 UTC 
In today's prioritized bugs meeting, we agreed to accept this as it makes dual boot with some Windows installations more difficult 
https://meetbot.fedoraproject.org/fedora-meeting-1/2023-04-19/fedora_prioritized_bugs_and_issues.2023-04-19-14.00.log.html#l-82
Comment 17 Fedora Admin user for bugzilla script actions 2023-04-25 00:10:55 UTC 
This package has changed maintainer in Fedora. Reassigning to the new maintainer of this component.
Comment 18 Aoife Moloney 2023-11-23 00:08:18 UTC 
This message is a reminder that Fedora Linux 37 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 37 on 2023-12-05.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '37'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, change the 'version' 
to a later Fedora Linux version. Note that the version field may be hidden.
Click the "Show advanced fields" button if you do not see it.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora Linux 37 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora Linux, you are encouraged to change the 'version' to a later version
prior to this bug being closed.
Comment 19 Gary Buhrmaster 2024-03-24 17:48:33 UTC 
As I recall, there is some experimental support in systemd-boot for windows bitlocker support (reboot-for-bitlocker) which has been stated that it is intended to be reworked at some point.  Moving to systemd-boot from grub is not going to be viable to all (and the systemd shim is not yet signed, although there is the open bug 2268695 to do so in the future), but it may be something to keep an eye on to see when/if it can provide a path forward.
Note You need to log in before you can comment on or make changes to this bug.