TPM laptop issue

When I received this laptop, TPM wasn’t activated, and on this HP Elitebook 8460p, enabling the TPM involved making admin passwords and activating various items (complicated sequence).

Therefore, I just simply installed without TPM, using BTRFS w/encryption for boot and root. The annoying part of this is that it asks for the same password twice—once to boot in grub, and once after the kernel loads. Again, same password, so that’s annoying, but not the problem I’m asking about.

After figuring out the complicated sequence involved in enabling TPM, I gave it a whirl a couple of days ago, and the laptop, with TPM enabled, doesn’t boot at all----gives me a “no bootable medium”. A few panicked steps later, I disabled TPM and returned the BIOS back to the previous settings, and it booted back up, so I’m working again the “old” way.

The question is…what am I missing? What about enabling TPM makes the bootable partitions on the drive completely disappear? Should I be considering pulling the drive, enable TPM, and then a reinstall on a NEW drive (then copy data/profiles over?), or is there some simple partition manupulation that I can do that “converts” this over to TPM compatible so it can boot the existing drive?

The ultimate goal—my expectations—are that once TPM is enabled, I won’t have a tremendous delay at grub when entering the password for the drives. Without TPM, it has to manually calculate, and it takes around 45 seconds to open the slot. Perhaps I’m misunderstanding TPM in this regard as well?

Regardless, any suggestions are welcome. After browsing through several forums both Suse and other distributions, the answers have not been “clear” enough for me to figure it out. Anyone who has experience in playing this little game—I’m sorry if it has been answered before—I’m just not getting the gist of where exactly this is all going wrong.

Serker

That particular issue was discussed in an earlier thread:
Boot encrypted root (encrypted boot)

You might find it useful to read that thread.

The question is…what am I missing? What about enabling TPM makes the bootable partitions on the drive completely disappear?

I don’t know the answer to that. I enabled TPM on one system. And the only difference that I can see is that I no longer see a startup message that TPM is disabled.

The ultimate goal—my expectations—are that once TPM is enabled, I won’t have a tremendous delay at grub when entering the password for the drives.

I am doubting that you will see much difference there.

TPM only works if the OS installed with the secure boot box checked I think. When checked the certificates need to secure boot are included. Without certs the UEFI (AKA BIOS) thinks the os has been modified and won’t boot. IMHO Secure boot is security theater since anyone able to mode the boot stack already owns the machine.

TPM does not directly have anything to do with encrypted partition, only the boot stack

And what are previous settings? Are you using EFI or legacy BIOS boot to start with?