TPM on 26.04 Testing

Project Discussion Pre-Release Discussion
23

Hello !

I’m also trying the TPM FDE on my Thinkpad P14s Gen 5 (Intel model), not so much luck either sadly. I’m using the latest daily ISO available with latest UEFI version available for the device, installer updated to the latest version when prompted.

Disk, UEFI and TPM have been all resetted before the setup. The ISO have been burned on the USB key with Etcher (so written in DD mode).

# test-ubuntu-tpmfde-compat /var/lib/snapd/hostfs/boot/efi/EFI/ubuntu/shimx64.efi /var/lib/snapd/hostfs/boot/efi/EFI/ubuntu/grubx64.efi /var/lib/snapd/hostfs/vmlinuz
Testing this platform for compatibility with EFI based TPM protected FDE
This platform is not suitable for FDE because of the following problem:
error with secure boot policy (PCR7) measurements: unexpected EV_EFI_BOOT_SERVICES_APPLICATION event for \PciRoot(0x0)\Pci(0x14,0x0)\USB(0xc,0x0)\HD(2,GPT,0cc98ca7-0ec4-4f2b-9750-c5465449bce2)\\EFI\BOOT\BOOTX64.EFI after already seeing a verification event during the OS-present environment. This event should be for the initial boot loader

Seems like it conflict in a weird way with the LiveCD boot environment, I’m not sure the understand what’s going on.

EDIT: I re-did the test after installing the OS on the disk (so bypassing the USB environment), it seems way better so something is off when booting from USB on my side:

# test-ubuntu-tpmfde-compat /var/lib/snapd/hostfs/boot/efi/EFI/ubuntu/shimx64.efi /var/lib/snapd/hostfs/boot/efi/EFI/ubuntu/grubx64.efi /var/lib/snapd/hostfs/boot/vmlinuz
Testing this platform for compatibility with EFI based TPM protected FDE

EFI based TPM protected FDE test support results:
- Best PCR algorithm: TPM_ALG_SHA256
- Secure boot CAs used for verification:
  1: subject=CN=Microsoft Corporation UEFI CA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US, SKID=0x13adbf4309bd82709c8cd54f316ed522988a1bd4, pubkeyAlg=RSA, issuer=CN=Microsoft Corporation Third Party Marketplace Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US, AKID=0x45665243e17e5811bfd64e9e2355083b3a226aa8, sigAlg=SHA256-RSA
- Flags: no-platform-config-profile-support,no-drivers-and-apps-config-profile-support,no-boot-manager-config-profile-support,request-partial-dtpm-reset-attack-mitigation
- Warnings:
  - error with platform config (PCR1) measurements: generating profiles for PCR 1 is not supported yet, see https://github.com/canonical/secboot/issues/322
  - error with drivers and apps config (PCR3) measurements: generating profiles for PCR 3 is not supported yet, see https://github.com/canonical/secboot/issues/341
  - error with boot manager config (PCR5) measurements: generating profiles for PCR 5 is not supported yet, see https://github.com/canonical/secboot/issues/323


Selected TCG PCRs: \[0x00000000 0x00000002 0x00000004 0x00000007\]

Here are my UEFI Secure Boot parameters from the Lenovo UEFI:

  • Secure Boot mode: User mode
  • Secure Boot Key State: Customized (always to Customized when allowing 3rd party UEFI CA)
  • Allow Microsoft 3rd Party UEFI CA: True (otherwise I can’t boot the USB key)

Here are the security report generated from the LiveCD environment:

Device Security Report
======================

Report details
  Date generated:                                  2026-03-22 15:22:30
  fwupd version:                                   2.0.20

System details
  Hardware model:                                  LENOVO 21G2CTO1WW
  Processor:                                       Intel(R) Core(TM) Ultra 5 125H
  OS:                                              Ubuntu Resolute Raccoon (development branch)
  Security level:                                  HSI:3! (v2.0.20)

HSI-1 Tests
  UEFI Platform Key:                               Pass (Valid)
  Firmware BIOS Region:                            Pass (Locked)
  UEFI Bootservice Variables:                      Pass (Locked)
  MEI Key Manifest:                                Pass (Valid)
  Intel Management Engine Version:                 Pass (Valid)
  TPM v2.0:                                        Pass (Found)
  Firmware Write Protection Lock:                  Pass (Enabled)
  Platform Debugging:                              Pass (Not Enabled)
  UEFI Secure Boot:                                Pass (Enabled)
  Intel Management Engine Manufacturing Mode:      Pass (Locked)
  BIOS Firmware Updates:                           Pass (Enabled)
  Firmware Write Protection:                       Pass (Not Enabled)
  TPM Platform Configuration:                      Pass (Valid)
  Intel Management Engine Override:                Pass (Locked)

HSI-2 Tests
  TPM Reconstruction:                              Pass (Valid)
  Intel BootGuard Fuse:                            Pass (Valid)
  Intel BootGuard ACM Protected:                   Pass (Valid)
  Intel BootGuard:                                 Pass (Enabled)
  IOMMU Protection:                                Pass (Enabled)
  BIOS Rollback Protection:                        Pass (Enabled)
  Platform Debugging:                              Pass (Locked)

HSI-3 Tests
  Pre-boot DMA Protection:                         Pass (Enabled)
  Suspend To RAM:                                  Pass (Not Enabled)
  Control-flow Enforcement Technology:             Pass (Supported)
  Suspend To Idle:                                 Pass (Enabled)

HSI-4 Tests
  Encrypted RAM:                                 ! Fail (Not Supported)
  Supervisor Mode Access Prevention:               Pass (Enabled)

Runtime Tests
  Linux Swap:                                      Pass (Not Enabled)
  UEFI db:                                         Pass (Valid)
  Firmware Updater Verification:                   Pass (Not Tainted)
  Control-flow Enforcement Technology:             Pass (Supported)
  Linux Kernel Verification:                     ! Fail (Tainted)
  Linux Kernel Lockdown:                           Pass (Enabled)

Host security events

For information on the contents of this report, see https://fwupd.github.io/hsi.html

I can test other settings if needed :slight_smile:

Florian

1 Like
24

Hello !

After re-checking, I didn’t have the latest daily ISO but this doesn’t work much either (same but different error):

error with system security: encountered an error when checking Intel BootGuard configuration: no hardware root-of-trust properly configured: system is in manufacturing mode

According to the report from fwupd from my last message, this should be fine as BootGuard seems “enabled” (from what I understand). I also re-run the test-ubuntu-tpmfde-compat tool, exactly the same message as previously.

Thanks !

25

I have just tried this again. Another fail. Unfortunately. I believe I followed all of the steps correctly (and logged the result). I was using 26.04 build 2026.04.10

I have updated my ASUS NUC13ANKi7 to the latest BIOS version (42).

The error I got was.

PCR_UNUSABLE

error with secure boot policy (PCR7) measurements: generating secure boot profiles for systems with timestamp revocation (dbt) support is currently not supported

tpmagain
tpmagain1920×1440 221 KB

I believe this is an ASUS issue, but they are not a helpful bunch.

1 Like
26

Hopefully these last couple weeks there’s some serious improvements

27

The TPM continues to fail, apparently I will have to wait until 26.10 to see if it works…

tpm
tpm1280×721 199 KB

1 Like
28

My computer is Xiaomi Book Pro 14.Meet the same “error with secure boot policy (PCR7) measurements: generating secure boot profiles for systems with timestamp revocation (dbt) support is currently not supported”

Screenshot From 2026-04-21 23-13-40
Screenshot From 2026-04-21 23-13-402024×1464 175 KB

ubuntu@ubuntu:~$ sudo test-ubuntu-tpmfde-compat /var/lib/snapd/hostfs/boot/efi/EFI/ubuntu/shimx64.efi /var/lib/snapd/hostfs/boot/efi/EFI/ubuntu/grubx64.efi /var/lib/snapd/hostfs/boot/vmlinuz
Testing this platform for compatibility with EFI based TPM protected FDE

This platform is not suitable for FDE because of the following problem:
error with secure boot policy (PCR7) measurements: generating secure boot profiles for systems with timestamp revocation (dbt) support is currently not supported

4 Likes
29

Hi there,
I have the same issue with my Lenovo Yoga 7 ARP8:
This platform is not suitable for FDE because of the following problem:
error with secure boot policy (PCR7) measurements: generating secure boot profiles for systems with timestamp revocation (dbt) support is currently not supported.
Secure boot enabled in standard mode (full amd machine), I installed the stable (not beta) version of ubuntu 26.04.
Hope they will fix this quickly

30

Another one for the pile: HP Elitebook 850 G7 Notebook PC. “error with secure boot policy (PCR7) measurements: generating secure boot profiles for systems with timestamp revocation (dbt) support is currently not supported”.

31

Have the same issue. Did anyone try clearing TPM?

32

I’ve tried to reset to factory keys the secure boot but I didn’t work.
I didn’t see any opton in my bios to clear the TPM.

33

Just tried on my desktop computer[1] (with 26.04 final), and the result is

error with system security: encountered an error when checking Intel BootGuard configuration: no hardware root-of-trust properly configured: BootGuard ACM is not active

That seems to happen irrespective of the state of Secure Boot in the UEFI settings.

  1. Intel Core i5-12500, Asus ROG Strix B660-G Gaming WiFi, ASUS TUF Gaming GeForce RTX 4070
    (I’m using TPM-based Bitlocker encryption in Windows on this system for quite a while) ↩︎

34

Hi, in case of the HP EliteBook series, you must disable the Absolute persistence module. By default, it is in inactive mode, and that is the cause of the issue. You are lucky, on this old model, you have the option to just disable, not permanently disable.
You can do this through HP WMI PowerShell commands.
I heard that it is also possible through the Linux native tools, but I have had no luck doing that.

35

Yes, I did this more than once. All to no avail.

36

I’m having the same issue on a Dell Latitude 5310 2-in-1. Tried resetting secure boot keys to their default, deleting custom ones, clearing the TPM. I could try disabling Intel TXT, but I doubt it’ll help. And the Absolute Persistence Module is set to disabled, so I’m running out of options here. Maybe it will be fixed in 26.04.1, who knows?

37

Also here FDE is not working at all with any of our Lenovo T14 or X1 models - it used to work with previous Ubuntu version.

We get:
Hardware-backed encryption could not be enabled.
This computer does not have the required security hardware (TPM 2.0)
for this encryption method.
Contact IT support.

Technical details:
NO_SUITABLE_TPM2_DEVICE
Error with TPM2 device: cannot check TPM discreteness using Intel BootGuard status:
no TPM2 device is available.

This seems to be the bug - weird that it was not fixed before the LTS release - I hope we dont have to wait till July to get this fixed on 26.04.1 - any idea @didrocks ?