Repository navigation
Closed
Labels
bug 🐛Programming errors, that need preferential fixingProgramming errors, that need preferential fixing
Description
systemd version the issue has been seen with
262
Used distribution
Arch Linux
Linux kernel version used
No response
CPU architectures issue was seen on
None
Component
No response
Expected behaviour you didn't see
0 failed units
Unexpected behaviour you saw
4 failed units
Steps to reproduce the problem
Update systemd to version 262. Reboot
Additional program output to the terminal or log subsystem illustrating the issue
UNIT LOAD ACTIVE SUB DESCRIPTION
● [email protected] loaded failed failed TPM NvPCR Measurement of User Record for UID 1000
● [email protected] loaded failed failed TPM NvPCR Measurement of User Record for UID 945
● systemd-pcrproduct.service loaded failed failed TPM NvPCR Product ID Measurement
● systemd-tpm2-setup-early.service loaded failed failed Early TPM SRK Setup
Sep 22 20:01:07 loq systemd-tpm2-setup[370]: Failed to initialize NvPCR index: No such file or directory
Sep 22 20:01:07 loq systemd-tpm2-setup[370]: Failed to initialize NvPCR index: No such file or directory
Sep 22 20:01:07 loq systemd-tpm2-setup[370]: Failed to initialize NvPCR index: No such file or directory
Sep 22 20:01:07 loq systemd-tpm2-setup[370]: Failed to initialize NvPCR index: No such file or directory
Sep 22 20:01:07 loq systemd-tpm2-setup[370]: 4 NvPCRs failed to initialize, proceeding anyway.
Sep 22 20:01:07 loq systemd[1]: TPM PCR NvPCR Initialization Separator skipped, unmet condition check ConditionPathExists=/etc/initrd-release
Sep 22 20:01:07 loq systemd[1]: Starting TPM NvPCR Product ID Measurement...
Sep 22 20:01:07 loq systemd-pcrextend[404]: Could not extend NvPCR: No such file or directory
Sep 22 20:01:07 loq systemd[1]: Failed to start TPM NvPCR Product ID Measurement.
Sep 22 20:01:09 loq systemd[1]: TPM PCR NvPCR Initialization Separator skipped, unmet condition check ConditionPathExists=/etc/initrd-release
Sep 22 20:01:09 loq systemd[1]: Starting TPM NvPCR Product ID Measurement...
Sep 22 20:01:09 loq systemd-pcrextend[661]: Could not extend NvPCR: No such file or directory
Sep 22 20:01:09 loq systemd[1]: Failed to start TPM NvPCR Product ID Measurement.
Sep 22 20:01:09 loq systemd[1]: TPM PCR NvPCR Initialization Separator skipped, unmet condition check ConditionPathExists=/etc/initrd-release
Sep 22 20:01:09 loq systemd[1]: Starting TPM NvPCR Product ID Measurement...
Sep 22 20:01:10 loq systemd-pcrextend[673]: Could not extend NvPCR: No such file or directory
Sep 22 20:01:10 loq systemd[1]: Failed to start TPM NvPCR Product ID Measurement.
Sep 22 20:01:10 loq systemd[1]: Starting TPM NvPCR Measurement of User Record for UID 945...
Sep 22 20:01:10 loq systemd-pcrextend[870]: Could not extend NvPCR: No such file or directory
Sep 22 20:01:10 loq systemd[1]: Failed to start TPM NvPCR Measurement of User Record for UID 945.
Sep 22 20:01:20 loq systemd[1]: Starting TPM NvPCR Measurement of User Record for UID 1000...
Sep 22 20:01:20 loq systemd-pcrextend[1176]: Could not extend NvPCR: No such file or directory
Sep 22 20:01:20 loq systemd[1]: Failed to start TPM NvPCR Measurement of User Record for UID 1000.Reacted by Bastien Orivel, Johannes Penßel, Arvin Verain, lanmarc77, johackim, Alexander Solovyov, Destinyrrj, matthewadie, Paweł Frelek, raeraex2 and 33 more
Metadata
Metadata
Assignees
Labels
bug 🐛Programming errors, that need preferential fixingProgramming errors, that need preferential fixing
Activity
Duncaen commentedon Sep 22, 2026
On my system it seem to be unable to find
tpm2-pcr-public-key.pem(when I run it from a booted system.)Edit: I resolved the not found issue by setting
PCRPKey=/etc/systemd/tpm2-pcr-initrd-public-key.pemin my/etc/kernel/uki.conf, since I have two pcr keys like in the example section of ukify man page.VoSed commentedon Sep 23, 2026
How to generate that key without breaking anything?
ChrisTX commentedon Sep 23, 2026
I'm also on Arch, and can confirm NvPCRs to work if
--sign-initrd-pcrsis used together withPCRPKey=. Specifically this part of the release notes is relevant:I am using the following
uki.conf:The issue I see however that
SignInitrdPCRs=yesis missing from the manpage - only the CLI switch--sign-initrd-pcrsis documented, see here.Edit I opened #43863 for the missing documentation entry.
VoSed commentedon Sep 23, 2026
My uki.conf is empty/default, secureboot enabled with sbctl
ChrisTX commentedon Sep 23, 2026
You need to use a signed PCR policy as the release notes explain. Without a PCR policy, NvPCRs will not work anymore. This is on top of sbctl. As you can see in my config, I use sbctl for the signing keys and then two separate keys for PCR policies.
VoSed commentedon Sep 23, 2026
Why not working feature enabled by default?
ChrisTX commentedon Sep 23, 2026
See the PR that introduced that change, #42796 , for the reasoning. There's been a bunch of security concerns with the previous anchoring approach.
VoSed commentedon Sep 23, 2026
And now it failed completely after update because keys never existed before and not been generated after
rlees85 commentedon Sep 23, 2026
Just upgraded Fedora 44 to 45 and now I have the same problem: fifty shades of red at boot. Now it feels like I have to become a TPM2 and PCR expert in order to resolve this. I understand security concerns but this is going to be heavy for users to figure out.
The first thing to figure out is if I now need to manage a new key for PCRs is this key distribution scoped or per-machine scoped? and if the latter how are immutable distributions going to manage that?
VoSed commentedon Sep 24, 2026
I am now curious. If disk encryption was enabled, system would be unbootable because this error?
ChrisTX commentedon Sep 24, 2026
The signing keys need to be generated. See the Arch wiki here and the
genkeycommand onukify(1)on how to do so.So, PCR 11 is dependent on UKI measurements and the boot phase. An immutable distribution can use an externally generated keypair and does not need to deploy this per machine. You only need access to the private key if the UKI changes.
This breaks the NvPCR definitions systemd creates. If you rely on any of these, then yes, it would break the disk decryption. However, the default NvPCR definitions are measured late in boot and aren't typically used for disk decryption.
VoSed commentedon Sep 24, 2026
What exactly cryptenroll command should be to just enroll generated keys to tpm? I'm not using luks.
after generating keys and editing uki.conf there is a new error:
Failed to initialize NvPCR index: Device not a stream. This is because keys are not enrolled?rlees85 commentedon Sep 24, 2026
fwiw, I'm now having exactly the same issue after following the steps in the Wiki and there is a bug open somewhere about it also (can't find it now though). I think the device is not a stream is a red herring and the actual error is that the NvPCR is already defined (confirmed by messing with TPM tools). Systemd seems to want to re-create it anyway. There is a chance my issue is selinux related, but if you are using Arch then maybe not
VoSed commentedon Sep 24, 2026
Is systemd-pcrlock-make-policy.service supposed to be disabled? Because on my system it is
111 remaining items
joan31 commentedon Oct 9, 2026
My solution to fix NvPCR initialization with systemd 262 using signed UKI PCR policies
I managed to resolve the NvPCR initialization failures after upgrading to systemd 262-1 on Arch Linux.
I am sharing my configuration, the steps that fixed the issue, and one remaining non-fatal TPM warning.
1. Initial configuration
My system uses:
sbctlfor signing EFI binariesmkinitcpioandsystemd-ukify0+7systemd-bootMy
/etc/mkinitcpio.confhooks:Initially, my UKIs were signed using
sbctl, but they did not contain the.pcrpkeyand.pcrsigsections.This configuration worked before upgrading to systemd 262.
2. Problem after upgrading to systemd 262
After upgrading, several TPM-related services failed, including:
The journal reported:
The four NvPCR indexes existed but were not initialized:
Reading them with
tpm2_nvreadreturned:3. Solution: Generate signed PCR policies and embed them in the UKI
I kept
sbctlfor Secure Boot signing and configuredukifyseparately for PCR policy signing.Step 1 — Generate the PCR signing key pair
Step 2 — Configure
/etc/kernel/uki.confThis allows
ukifyto embed the PCR public key and signed PCR policies into the UKI.Step 3 — Rebuild the UKIs
Both default and fallback UKIs were rebuilt and signed by my existing
sbctlpost-hook.Step 4 — Verify the UKI sections
The UKI now contains:
Secure Boot signatures were also verified:
4. Results after reboot
After rebooting, all previously failing services started successfully.
Result:
The four NvPCR indexes are now initialized:
All four indexes now have valid SHA-256 values.
The journal confirms successful initialization:
Subsequent measurements also work:
Secure Boot, measured UKI, measured OS, and automatic TPM2-based LUKS2 unlocking are all working.
5. Remaining non-fatal TPM warning
There is still one minor issue.
During early TPM initialization,
systemd-tpm2-setuplogs the following error four times:The TPM error
0x14Ccorresponds toTPM_RC_NV_DEFINED, indicating that the NV index is already defined.Immediately afterward, systemd reports:
The service finishes successfully.
I verified all four NV indexes with:
All indexes exist, have the
writtenattribute, use SHA-256, and share the same authorization policy.The NvPCR measurements continue to work, so this appears to be a non-fatal issue.
Could this be an expected
NV_DefineSpaceattempt on already existing indexes, or is there an opportunity to avoid these TPM2-TSS error messages during initialization?I have not deleted or recreated the NV indexes, since everything is functioning correctly.
6. Package versions
Conclusion
In my case, the NvPCR initialization failures after upgrading to systemd 262 were resolved by adding signed PCR policies to my UKIs using
ukify.The resulting boot chain is:
No TPM clearing, NV index deletion, or LUKS2 re-enrollment was required.
The only remaining issue is the non-fatal
TPM_RC_NV_DEFINED (0x14C)warning during early initialization.Hopefully, this helps others using Arch Linux, signed UKIs, Secure Boot, and TPM2 with systemd 262.
marskodev commentedon Oct 11, 2026
To people that want an alternative to using ukify and also use dracut, I have made a PR to dracut at dracut-ng/dracut#2784. It has yet to be reviewed and merged, but it's there if anyone wants to test it. It has worked fine on my own machine, but my TPM only uses sha256 for its PCR banks, but the code should technically pick up on banks with different algorithms. It adds an 'initrd' policy reference by default to the signature, which is what is needed now for NvPCR values to be defined or initialized.
It also works when dracut uses ukify, which it does by default when it is installed.
tpm2: Don't fail NvPCR initialization if there is no initial write po…
tpm2: Don't fail NvPCR initialization if there is no initial write po…
tpm2-util: fall back to a PCR policy for NvPCR initialization (#44078)
katexochen commentedon Oct 14, 2026
Closing this, as the systemd side is addressed by #43948 and #44078, both of which will be part of v263 (and #43948 backported to stable):
If you still see problems with v263, please open a new issue.
iyanmv commentedon Oct 15, 2026
If you are annoyed by the "failed" units on boot, don't want to wait for v263, you have never used TMP to unlock your LUCKS (or not using LUKS at all!), know nothing about NvPCRs, simply add
systemd.tpm2_measured_os=0to your kernel parameters. Quick and easy. For more detailed information, but very well digested, read this post.tpm2: Don't fail NvPCR initialization if there is no initial write po…
tpm2: Don't fail NvPCR initialization if there is no initial write po…
tpm2: Don't fail NvPCR initialization if there is no initial write po…
tpm2: Don't fail NvPCR initialization if there is no initial write po…
Add TPM PCR policy configuration and Noctalia theme integration (#53)
mokkurkalve commentedon Nov 12, 2026
Late comment. But it might help somebody. It seems 262 changed to use Agon2id for --tpm2-with-pin=yes. Opening 3 LUKS2 volumes in parallel at boot was too much for the 16GB RAM on my Yoga laptop and it resulted in an OOM situation. Logging in with TPM2 keys could never succeed. Replacing --tpm2-with-pin=yes with --tpm2-with-pin=direct solved the issue. I rolled new TPM2 keys w/pin on my 3 LUKS2 volumes and it works flawlessly.
Also, probably good idea: remove all custom compression choices from mkinitcpio.conf.
benjarobin commentedon Nov 12, 2026
@mokkurkalve The proper fix is to use this option https://www.freedesktop.org/software/systemd/man/latest/systemd-cryptenroll.html#--tpm2-argon2id-memory=BYTES