TPM backed encryption on Dell Precision 5490 results in asking for Recovery Key endlessly.

[Alslinet]

There are a number of issues here. The primary one being that im asked for the recovery key after installing ubuntu 26.04 LTS.
The other issue is it seems to initiatite a reboot after some time on the recovery key screen. This would be impossible for a person with a disability to enter before the boot happens. My suggestion is drop the restarte on this screen completely and figure out whats wrong with the PCRs. I havent been able to find the specific details.

This happens consistently after numerous rounds of:

• Verifying secure boot is enabled
• Clearing the TPM
• Installing Ubuntut 26.04 LTS and enabling hardware backed (TPM) encryption.

[Alslinet]

Same issue occurs on Dell Latitude 5450.

[Alslinet]

Looking into it furthere these seem to be relevant events:
snap-bootstrapError with keyslot "default":
cannot recover keys from keyslot:
incompatible key data role params:
invalid PCR policy data:
cannot complete authorization policy assertions:
the PCR policy is not authorized for the current configuration

Fallback also fails:
snap-bootstrapError with keyslot "default-fallback":
cannot recover keys from keyslot:
incompatible key data role params:
invalid PCR policy data:
cannot complete authorization policy assertions:
the PCR policy is not authorized for the current configuration

[Alslinet]

Let me know if you need any additional logs.

[Alslinet]

The problem also appears on the Dell Pro Max.

[frederic-hoerni]

To investigate the issue, could you please provide more logs (at install time):

• The installation logs: journalctl -b0 -u snapd.service
• The TCG event log: /sys/kernel/security/tpm0/binary_bios_measurements
• If you have network access: install tpm2-tools and run tpm2_pcrread

The detailed procedure is as follows:

• Start the Ubuntu 26.04 live CD
• Close the installer
• Open a terminal
• sudo systemctl edit snapd.service and add these 2 lines:

[Service]
Environment=SNAPD_DEBUG=1

• sudo systemctl restart snapd.service
• Start the installer (there should be an icon "install RELEASE")
• Proceed with the installation, selecting TPM-backed disk encryption
• At the end ("ubuntu 26.04 is installed and ready to use") click "continue testing" (do not reboot)
• Collect the 3 aforementioned items:
  • journalctl -b0 -u snapd.service
  • /sys/kernel/security/tpm0/binary_bios_measurements
  • if you have network access:

        sudo apt update
        sudo apt install tpm2-tools
        sudo tpm2_pcrread