Fixing the Ubuntu Boot Loader on a Surface Pro 4

Last week I had a bit of a (mis)adventure with my Surface Pro 4. I’m sure something similar is bound to happen again, so as I usually do I’m writing down what I had to do to fix the problem, so next time I’ll be prepared. I’m also (again as usual) making this public so anyone else who finds themselves in the same situation can benefit. I’ll start with some context, so skip ahead if you’re looking for the solution. The section headings will help you.

Context and Background

I’ve been a (mostly) happy Surface user for the past year or so. As per my usual experience with Microsoft products, the hardware is top notch, but the overall experience suffers from those software oddities that just make things sub-par. For example, it’s practically impossible to use the machine without the Type Cover, as pretty much anything you try to do in Windows requires some typing. And the on-screen keyboard just doesn’t appear with the regularity I’ve become accustomed to on Android devices. So it’s hard to think of the device as a (powerful) tablet. The only exception is the built-in application to read and annotate PDFs. The screen is large and crisp enough to read a full A4 paper without zooming, and the pen is just perfect for scribbling as if on paper. (This was a principal use case for me, and nothing else on the market at the time could really compare.)

On the other hand, as a laptop replacement it’s ace. I’m (unusually for 2017) still a desktop user: I have beefy desktops at home and at work, and I do most of my computer stuff on one or the other. So I only need portable compute devices for two things: travel (particularly work-related) / out-of-office collaborations and presentations (i.e. hooking the thing up to a projector). So my ideal portable computer is light and small. But big enough to a) type on properly, without fighting the keyboard all the time, and b) to have a decent high-res screen. And of course it needs a proper CPU to handle my usual work requirements, including compilation of code and running short experiments and visualisation scripts. In all these senses the Surface Pro (the Intel i5 / 8GB / 256GB model) fits the bill nicely.

An added complication is that my primary OS at home and at work is Ubuntu (currently 16.04 LTS). So my whole setup is geared towards that, particularly for work-related matters. This means I wanted to install Ubuntu on my Surface at the first opportunity. I took my time before jumping in though, as I quickly realized (on my initial install) that the Type Cover, WiFi, touch screen, and pen would not work out of the box. That’s pretty crippling. Eventually, though, I bit the bullet and with the help of the nice guys on Reddit went through the necessary steps to get Ubuntu to work properly on the machine, with Windows as a dual-boot option.

Problem Description

All this worked well until a couple weeks ago, when for some reason I was asked for the Bitlocker key on booting into Windows. There must have been some change to the configuration, either on Ubuntu or Windows, that triggered this, but I cannot for the life of me remember what. I always carry that with me (suitably encrypted of course), so I punched that in and continued with what I was doing. Next time I used the device, on a work visit to Heidelberg, I realised I could no longer boot into Ubuntu. This was very problematic, as all the code, scripts, and programs I needed were there… And I knew from experience that I’d need a USB hub, keyboard, mouse, and USB boot stick to even attempt to fix things.

Long story short, I borrowed the necessary stuff, created a USB boot stick, and tried to fix things by booting into rescue mode and reinstalling the bootloader. Unfortunately that still didn’t work, so I agonized for a couple days on how to fix this.

Solution

It turns out the solution is really rather simple, and basically involves the following steps:

1. Boot into UEFI setup. To do this, power down the machine, and hold the +volume button while hitting the power button.
2. In UEFI setup, go into the “Security” tab and disable “Secure Boot”. Ignore any complaints.
3. Plug in the USB hub, keyboard, mouse, and USB boot stick, and boot into it. To do this, from UEFI setup go to “Boot configuration” and swipe left on “USB Storage”.
4. This should boot into Ubuntu on the USB stick.
5. Fix the bootloader. Personally I had the Ubuntu 16.04 LTS server installation image there, where I opted for the rescue mode. This allowed me to mount my root partition (after entering the decryption key) and reinstall GRUB.
6. Reboot into UEFI setup (c.f. step 1).
7. In UEFI setup, go into the “Security” tab and enable “Secure Boot” for both Microsoft and 3rd party CA keys.
8. Reboot, and things should work fine again, as in you should be presented with the GRUB prompt. To get into Windows, you’ll have an option to continue with the Windows Boot Loader from GRUB.

Now the odd thing is that I do not recall needing to mess around with Secure Boot when I first installed Ubuntu on the Surface. But then this was long enough ago that I may have simply forgotten. I know for a fact that I wanted to write a blog post about that process, but never did, simply because it took me so long from initial install to when I got the Type Cover, touch screen, pen, etc working properly. For the record, I followed this set of instructions, opting for fridgecow’s kernel.