Arch Linux

Enable auto-decrypt for LUKS encrypted boot drive (Btrfs) with TPM 2.0

• Install the necessary tools: sudo pacman -S tpm2-tss tpm2-tools
• Identify the LUKS partition (the one with FSTYPE as crypto), and note down its NAME and UUID: lsblk -f
• Enroll the TPM keyslot: sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 /dev/<NAME>
• Open /etc/mkinitcpio.conf, and find the HOOKS=(...) line. Within the braces, replace udev with systemd, and encrypt with sd-encrypt.
• Open /etc/default/grub, and find the line GRUB_CMDLINE_LINUX="...". Look for cryptdevice=<UUID>=...:root, and replace it with rd.luks.name=<UUID>=root root=/dev/mapper/root
• Regenerate and reboot:

  sudo mkinitcpio -P
  sudo grub-mkconfig -o /boot/grub/grub.cfg

Enable Plymouth splash screen for boot

• Install Plymouth: sudo pacman -S plymouth
• Open /etc/mkinitcpio.conf, and find the HOOKS=(...) line. Within the braces, add plymouth after systemd, but before sd-encrypt [!IMPORTANT]
• Find the MODULES(...) line, and add amdgpu and btrfs to it.
• Open /etc/default/grub, and add the following to GRUB_CMDLINE_LINUX_DEFAULT="...": quiet splash loglevel=3 rd.systemd.show_status=auto rd.udev.log_priority=3 vt.global_cursor_default=0
• Regenerate and reboot:

  sudo mkinitcpio -P
  sudo grub-mkconfig -o /boot/grub/grub.cfg