I hate TPM

Do you want to know a fun activity you can do on a Friday evening? Do you want to get locked out of your main computer due to a feature you don’t even use? No problem, just update your UEFI Secure Boot keys.

Now why do I get enraged about an update of some keys? Let me tell you the story.

So last Friday I found some time and upgraded my main laptop from Ubuntu 22.04 to Ubuntu 26.04. (Yes, I never upgraded to 24.04. 22.04 ran just fine and received security updates, so why bother.) For that I did a full reinstall of the system (as I always do with mayor OS upgrades).

All that ran fine and dandy, and reinstalling my software and restoring the Home directory was no problem at all. But then I got a notification that firmware updates for KEK CA, UEFI CA and UEFI dbx are available. (I didn’t get those notifications on 22.04.) As these are only new signing keys for Secure Boot¹, I just clicked Update without further thoughts. Bad idea. The update failed.

After a restart the system didn’t boot up, and I knew my Friday evening was ruined.
The laptop turned on. The bios worked. GRUB worked. I could select an OS in the GRUB menu. But that’s it. A black screen and a glowing keyboard (The keyboard RGB worked).

My first idea was to change the kernel and some kernel parameters. Maybe there was something wrong with the kernel, initramfs or similar. So I tried booting from an older kernel, with nomodeset and some other kernel parameter the internet and AI told me. Nothing worked.
My second idea was to boot a rescue system. The system is a network bootable system. It booted into the system and downloaded the image, but when he tried to boot the image it didn’t work. It stopped at the message EFI stub: Measured initrd data into PCR 9. Now I at least knew that the currently installed kernel or the current initramfs are not the problem.

After looking that message up I found out that PCR 9 has something to do with TPM. Oh great, I only heard good news about TPM in the past and that it never makes problems. NOT!

So the next thing was to go into bios. The first thing was to disable Secure Boot, but it was already disabled (always has been). Then I reset the Secure Boot keys. The system still wouldn’t start. (Mind you that Secure Boot has been disabled all the time). Than I erased all keys. Still no system start. Then I tried to disable TPM entirely, but the BIOS didn’t let me. I only was allowed to Clear TPM. Still no success.

The next thing I tried was to clear CMOS. After disconnectiong and connection the power cable and pressing some button in a certain order and for a certain time it did what it supposed to do (Clear CMOS), but it still wouldn’t boot.

As time progressed, the Friday was ruined and my head hurt. The next option I had was to update the BIOS. (as this was already the latest BIOS version, I would just flash the BIOS with the same version.) But because you can ruin your BIOS entirely when it failes during the update, I planned it for the next day.

Next day. First task was to flash my BIOS, so I can start the day with breakfast and a YouTube video. I partitioned my USB drive to FAT32, put the required data onto it, booted from that drive and executed the tasks accoding to the manifacturer manual. An then, fingers crossed.

The update worked flawlessly. The computer restarted, and Ubuntu finally booted. Yay. The keys are still not updated, but that doesn’t matter. I don’t use Secure Boot anyway.
Now I just need to find a way to disable the notifications that UEFI updates are available.

Oli out.