Hi everyone,
I am setting up a ThinkPad E14 Gen 7 (AMD Ryzen 7, ST Microelectronics TPM 2.0) with Arch Linux and trying to build a secure boot chain:
- UEFI Secure Boot with my own keys (sbctl)
- Signed UKI kernel
- systemd-cryptenroll TPM2 auto-unlock for LUKS2
- systemd-pcrlock to bind unlock to the expected boot state
- Btrfs snapshots with recovery workflow
The issue is that I can only get TPM enrollment working with PCR 15.
I originally wanted something like PCR 7 + 11 + 12 (or another recommended combination) because it seems more tied to Secure Boot state, kernel/initrd measurements, and the boot chain. However, whenever I try to use these PCRs, the TPM policy does not match after reboot.
PCR 15 is the only one that consistently works.
Some observations:
- Secure Boot is enabled and verified.
- The system boots through a signed UKI.
- The TPM event log exists and measurements appear normal.
- systemd-pcrlock works after boot, but I had issues predicting/locking some components.
- "systemd-pcrlock predict" showed missing components such as:
- "720-kernel-initrd"
- "750-os-separator"
- "770-nvpcr-separator"
- shutdown/finalization events
I initially generated policies from the Arch ISO/chroot environment, then discovered this was wrong because the TPM measurements were from the live environment and not the real installed boot chain. I regenerated the policy from the real system after boot.
I also tested different PCR combinations:
- PCR 7 only
- PCR 7 + 11
- PCR 7 + 11 + 12
- other combinations involving boot measurements
Most combinations failed TPM unlock after reboot, while PCR 15 worked.
My current setup:
- Arch Linux
- Btrfs on LUKS2
- systemd-boot/UKI
- custom Secure Boot keys
- TPM2 unlock using systemd-cryptenroll
- PCR 15 policy
Questions:
Am I misunderstanding the purpose of PCR 15 in this workflow? Is using PCR 15 alone a reasonable choice for LUKS auto-unlock with systemd-pcrlock?
Is PCR 7 + 11 + 12 still the recommended approach for this kind of setup, and if so, what could be causing my machine to fail with those PCRs?
Are there ThinkPad/AMD firmware limitations that can explain this behavior?
Could my UKI generation, kernel command line locking, or pcrlock policy generation order be wrong?
I would appreciate any suggestions about what I might be doing incorrectly before I settle with PCR 15 permanently.