PCR_UNUSABLE after already seeing a verification event during the OS-present environment

[jw-rav]

enabled secure boot and tied to install TPM backed FDE using ubuntu-26.04-desktop-amd64.iso gives me:

Resetting TMP to factory settings does not help.

This is on a Lenovo X13 Gen 3.

Also tried the measurements listed under "Learn more about hardware backed encryption". Did not help.

[jw-rav]

The error message is NOT about the target disk where the system is about to be installed.
The error message is about the EFI partition on the USB-drive containing the ubuntu-26.04-desktop-amd64.iso, which I am trying to install the system from.

[rmfrankch]

Reproduction on ThinkPad X1 Carbon 11th Gen

I can reproduce the same PCR_UNUSABLE failure on a ThinkPad X1 Carbon 11th Gen (machine type 21HN).

Hardware / firmware

• Machine type: 21HNS4LC00
• BIOS: N3XET65W (1.40)
• TPM: TPM 2.0, NTC/NPCT75x, firmware 1.59
• UEFI boot: confirmed
• Secure Boot: enabled

Ubuntu / installer

• ISO: ubuntu-26.04-desktop-amd64.iso
• ubuntu-desktop-bootstrap: 26.04.1, revision 665
• Channel: 26.04/edge
• snapd: 2.75.2

The hardware-backed encryption check fails during the installer, before starting an installation. The productive Ubuntu installation on the laptop was not modified.

The error is:

PCR_UNUSABLE

error with secure boot policy (PCR7) measurements:
unexpected EV_EFI_BOOT_SERVICES_APPLICATION event for
\PciRoot(0x0)Pci(0x14,0x0)USB(0x8,0x0)HD(2,GPT,2fd80be-e145-40c5-aa51-61a53ab5282e)\\EFI\BOOT\BOOTX64.EFI
after already seeing a verification event during the OS-present environment.
This event should be for the initial boot loader.

The TPM is otherwise functioning normally. For example, tpm2_getcap properties-fixed reports TPM 2.0, and PCR 7 is readable. Secure Boot is also reported as enabled by mokutil --sb-state.

I initially tested the installer from the official Ubuntu 26.04 ISO, written directly to USB. I then updated ubuntu-desktop-bootstrap to the current 26.04/edge revision shown above and repeated the test; the result was exactly the same.

The TPM event log also shows the relevant EV_EFI_BOOT_SERVICES_APPLICATION measurement associated with \EFI\BOOT\BOOTX64.EFI, in addition to the expected Secure Boot/PCR7 variable measurements.

This appears to be closely related to the behaviour reported here, but it occurs on a different Lenovo platform. I would be interested to know whether this is the same underlying firmware/event-measurement issue and whether a fix is expected to allow hardware-backed FDE on this machine.

I would very much like to use TPM-backed hardware encryption on this laptop, so I am reporting this rather than falling back to passphrase-only encryption.