PCR is the name of a registered value in your TPM module.
Did you disable or otherwise changed your Secure Settings in your BIOS? That would do it.
this post was submitted on 09 Dec 2025
0 points (NaN% liked)
Linux
65813 readers
1011 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 7 years ago
MODERATORS
Any changes in the boot process should change various PCR registers. https://wiki.archlinux.org/title/Trusted_Platform_Module#Accessing_PCR_registers
Nah. Specific field registers for specific things, and something like Bitlocker doesn't watch ALL of them.
From the few docs I can find, it looks like 0,2,4, and 11. Pretty common.
I suppose I could have phrased that better. The registers themselves correspond to particular applications/stages, but the values store in those registers should change based on how the application/stage was loaded. Switch the order or inject a new binary and the hash from that stage on should change.
Have you found a fix?
I had to disable bitlocker
The permanent "fix" that i done a few weeks later was to do single boot with fedora and move windows in a VM under KVM
I have given up dual-booting and just have a Windows VM for work things that require Windows. Less muss, less fuss and I can move the VM around as needed when moving between primary PCs.
did you have to buy a windows license to do it?
You may want to Google for a dev called Massgrave.
Is their GitHub account called massgravel (with an L at the end)? Or is that someone typo-squatting?
Just checked, massgravel (with an L) is right.
This. And fuck secure boot. Nowadays almost any of can run VMs flawlessly.
You can even use SecureBoot and TPM in a VM ;) OVMF EDK2 fully supports both ;)
SecureBoot is fine, sucks that vendors won't add distro keys but you can do that yourself, or use the shim.
Or just disable it in UEFI and forget about it.
Security tools are there for a reason. Sure, I can encrypt my Linux rootfs, but that doesn't stop anyone from tampering with the initramfs. Secure Boot + UKI does.
Cool. I still prefer to disable it.