PCR_UNUSABLE on hardware (intel xeon + nvidia)

[p-gentili]

Image: 23th Feb, https://cdimages.ubuntu.com/ubuntu/daily-live/pending/resolute-desktop-amd64.iso
Machine: https://certification.canonical.com/hardware/202406-34161 (Intel(R) Xeon(R) w7-2595X, NVIDIA - 10de:28b0)

Hardware-backed encryption could not be enabled 
There is an issue with this computers firmware. Contact IT support, or choose a different encryption method. 
Technical details 
PCR_UNUSABLE error with boot manager code (PCR4) measurements: encountered pre-OS EV_EFI_BOOT_SERVICES_APPLICATION event for \ Fv(cdbb7 b35-6833-4ed6-9ab2-57d2acddf6f0)\ FvFile(bldac9bd-132e-4f91- 62ca-14fdc65bd661) when no sysprep applications are expected 

The test snap was reporting

"Testing this platform for compatibility with EFI based TPM protected FDE

This platform may be suitable for FDE if the following problem is fixed:
addon drivers were detected:
- [no description] path=\PciRoot(0x10)\Pci(0x1,0x0)\Pci(0x0,0x0)\Offset(0xfc00,0x261ff) authenticode-digest=TPM_ALG_SHA256:123f4d33d2294bde094469feff4b643060afcc100c38269cd078f6f4745903f8
"

[chrisccoulson]

Did you have to enter the firmware settings to boot this? (I guess so). Would it be possible to perform a normal install on this system, boot normally (without entering the firmware settings) and then attach '/sys/kernel/security/tpm0/binary_bios_measurements` here (or send it directly to me on MM). I'm curious whether this is an artefact of entering the firmware settings or whether it's some other HP firmware component that is executed on every boot. We need to figure out which it is because one of them needs to be ignored when creating the initial profile.

[p-gentili]

Hello @chrisccoulson

1. I tried to boot from USB w/o passing by the firmware (the boot order was set already, I just had to reboot the machine). No luck
2. Got your file, machine is running 24.04 ATM, I hope that is not an issue (sending over MM, cannot attach link).

[p-gentili]

Another similar issue detected by @fernando79513,

PCR_UNUSABLE
error with secure boot policy (PCR7) measurements: unexpected
EV_EFI_BOOT_SERVICES_APPLICATION event for
\PciRoot(0x0)\Pci(0x14,0x0)\USB(0x14,0x0)\HD
(2,GPT,20e7e352-9438-47f0-9de3-cd34ef1e18ba)\EFI\BOOT\BOOTX64.EFI
after already seeing a verification event during the OS-present
environment. This event should be for the initial boot loader

machine: https://certification.canonical.com/hardware/202404-33976/ (Intel(R) Core(TM) i7-14700)

does it deserve a separate issue? need some more details? @chrisccoulson

EDIT: the test tool was reporting

"Testing this platform for compatibility with EFI based TPM protected FDE

This platform may be suitable for FDE if the following problem is fixed:
error with system security: no kernel IOMMU support was detected
"

[didrocks]

@p-gentili Chris told me that’s probably a separate bug. Do you mind filing it separately?

[fernando79513]

New issue created:
#517