More amd64 UC20 FDE/Secure Boot issues

device
1

I’ve spent a fair bit of time trying to get Full Disk Encryption (FDE) along with Secure Boot working on an Intel board. Here’s what I’ve done so far:

  • Clear the TPM
  • Use a LiveCD instance of Classic to flash out the amd64 UC20 image from 2021-06-30 using xzcat /path/to/image.img.xz | sudo dd of=/dev/sda bs=32M status=progress; sync
  • Boot the system into the Core 20 environment

Everything seems to go fine this far:

B2F09FCA-1502-4D75-AB19-C98037FD0D61_1_102_o
B2F09FCA-1502-4D75-AB19-C98037FD0D61_1_102_o2048×1536 821 KB

What’s noteworthy in the above screenshot is that:

  • The installer found the Secure Boot
  • The system found the TPM device
  • The installer was able to properly encrypt the file system

Now, after the system reboots, this is where it breaks:

Screen Shot 2021-12-03 at 7.05.04 PM
Screen Shot 2021-12-03 at 7.05.04 PM2610×1474 1.06 MB

Having had a chat with @ondra about this, he suggests that it most likely is an issue with the TPM is unable to unlock the disk, and thus reverting to trying to unlock it with the recovery key.

Booting up on a LiveCD, I was able to again verify that TPM seems to be working:

$ dmesg | grep -i tpm
[    0.000000] efi: ACPI 2.0=0x8c5c6000 ACPI=0x8c5c6000 TPMFinalLog=0x8c62f000 SMBIOS=0x8cac2000 SMBIOS 3.0=0x8cac1000 MEMATTR=0x876b9018 ESRT=0x8991e298 RNG=0x8caeca98 TPMEventLog=0x82b04018
[    0.021465] ACPI: TPM2 0x000000008C60DEC0 000034 (v04 ALASKA A.M.I    00000001 AMI  00000000)
[    0.021508] ACPI: Reserving TPM2 table memory at [mem 0x8c60dec0-0x8c60def3]

I did also run across this post, which seems to describe a very similar issue but without any resolution.

2

@ijohnson You don’t happen to have any thoughts here?

3

You should file a LP bug, I don’t know what the issue is here, but it does seem related to the TPM but the person I would ping to look at this is not on this forum, but they are on LP so I can ping them there

4

No problem. I’ll raise an LP issue for that and DM you the link.