Re: How to boot Windows when Bitlocker enabled with key sealed in TPM

2022-03-25 Thread Chris Murphy
On Fri, Mar 25, 2022 at 5:00 PM Chris Murphy wrote: > > On Fri, Mar 25, 2022 at 2:32 PM Vladimir 'phcoder' Serbinenko > wrote: > > > > On Fri, Mar 25, 2022 at 9:14 PM Chris Murphy > > wrote: > > > > > > For all practical purposes, this is functionally the end to dual boot > > > in GRUB, if ther

Re: How to boot Windows when Bitlocker enabled with key sealed in TPM

2022-03-25 Thread Chris Murphy
On Fri, Mar 25, 2022 at 2:32 PM Vladimir 'phcoder' Serbinenko wrote: > > On Fri, Mar 25, 2022 at 9:14 PM Chris Murphy wrote: > > > > For all practical purposes, this is functionally the end to dual boot > > in GRUB, if there is no work around, e.g. bootnext. Is that the > > direction GRUB maintai

Re: How to boot Windows when Bitlocker enabled with key sealed in TPM

2022-03-25 Thread Vladimir 'phcoder' Serbinenko
On Fri, Mar 25, 2022 at 9:14 PM Chris Murphy wrote: > > For all practical purposes, this is functionally the end to dual boot > in GRUB, if there is no work around, e.g. bootnext. Is that the > direction GRUB maintainers want to go in? Why don't you just update TPM with new values? Then it will ge

Re: How to boot Windows when Bitlocker enabled with key sealed in TPM

2022-03-25 Thread Chris Murphy
For all practical purposes, this is functionally the end to dual boot in GRUB, if there is no work around, e.g. bootnext. Is that the direction GRUB maintainers want to go in? -- Chris Murphy ___ Grub-devel mailing list Grub-devel@gnu.org https://lists.

Re: How to boot Windows when Bitlocker enabled with key sealed in TPM

2022-02-12 Thread Lennart Sorensen
On Thu, Feb 10, 2022 at 02:13:43PM -0700, Chris Murphy wrote: > If you boot windows once a day, it's changing what, 1-4 bytes, per > day? The entry for Windows is already in NVRAM, it doesn't need to be > written each time. You're only changing the BootNext value that points > to the Windows entry

Re: How to boot Windows when Bitlocker enabled with key sealed in TPM

2022-02-10 Thread Chris Murphy
On Thu, Feb 10, 2022 at 12:29 PM Lennart Sorensen wrote: > > On Thu, Feb 10, 2022 at 11:46:33AM -0700, Chris Murphy wrote: > > On Thu, Feb 10, 2022 at 10:18 AM Lennart Sorensen > > wrote: > > > > > > On Mon, Feb 07, 2022 at 04:48:43PM -0700, Chris Murphy wrote: > > > > One idea I've heard floated

Re: How to boot Windows when Bitlocker enabled with key sealed in TPM

2022-02-10 Thread Lennart Sorensen
On Thu, Feb 10, 2022 at 11:46:33AM -0700, Chris Murphy wrote: > On Thu, Feb 10, 2022 at 10:18 AM Lennart Sorensen > wrote: > > > > On Mon, Feb 07, 2022 at 04:48:43PM -0700, Chris Murphy wrote: > > > One idea I've heard floated is, having GRUB alter efivars such that > > > BootNext is changed to do

Re: How to boot Windows when Bitlocker enabled with key sealed in TPM

2022-02-10 Thread Chris Murphy
On Thu, Feb 10, 2022 at 10:18 AM Lennart Sorensen wrote: > > On Mon, Feb 07, 2022 at 04:48:43PM -0700, Chris Murphy wrote: > > One idea I've heard floated is, having GRUB alter efivars such that > > BootNext is changed to do a one time boot of Windows, instead of using > > chainloader. If BIOS, us

Re: How to boot Windows when Bitlocker enabled with key sealed in TPM

2022-02-10 Thread Lennart Sorensen
On Mon, Feb 07, 2022 at 04:48:43PM -0700, Chris Murphy wrote: > One idea I've heard floated is, having GRUB alter efivars such that > BootNext is changed to do a one time boot of Windows, instead of using > chainloader. If BIOS, use chainloader as now. If UEFI, set BootNext > efi variable? This has

Re: How to boot Windows when Bitlocker enabled with key sealed in TPM

2022-02-09 Thread Chris Murphy
Found this: [PATCH v1 2/2] core: commands: efi: add commands to get/set EFI vars https://lists.gnu.org/archive/html/grub-devel/2020-05/msg00027.html But I haven't seen any discussion on whether to support get/set EFI vars. Would it be possible to constrain the support to setting just "BootNext" f

How to boot Windows when Bitlocker enabled with key sealed in TPM

2022-02-07 Thread Chris Murphy
Hi, It's increasingly common to see Windows 10 systems with full disk encryption (BitLocker) enabled out of the box, with the encryption key sealed in the TPM 2.0. [1][2][3] The system uses Measured Boot to determine if boot related components have been tampered with, and if not, the BitLocker ke