AMD Framework 13 with Nix, Secure Boot, & home-manager

Processor & GPU

The processor and GPU are AMD. I prefer AMD. Also the Radeon 860M can be used with ollama.

$ cat /proc/cpuinfo | grep '^model name' | head -n1
model name      : AMD Ryzen AI 7 350 w/ Radeon 860M

This means that I have the AMD Pod Security Processor, AMD’s parallel to the Intel Management Enginge. The downside is, obviously, these secondary processors are often vulnerable and have privileged access to system hardware. The upside is this provides functionality such as Secure Boot.

As far as I know, it is not currently possible to use CoreBoot on the latest AMD Framework 13, but experimental support is in progress for the previous gen of AMD CPUs, leaving me hopeful that we will see it here eventually.

However, the default firmware supports Secure Boot with custom keys, which is good enough for me at the moment.

Trackpad

The trackpad impressed me. From what I hear, Apple has a patent on trackpads where the full tactile buttonpress can happen over the full Trackpad surface. So this trackpad lets you tap anywhere but the top half-centimeter or so. Not a bad compromise.

In my home-manager config for sway, I used this to get closer to Apple’s trackpad settings.

# framework laptop touchpad
"2362:628:PIXA3854:00_093A:0274_Touchpad" = {
  scroll_factor = "0.5";
  accel_profile = "adaptive";
  pointer_accel = "-0.1";
  dwt = "enabled";
  click_method = "clickfinger";
};

Keyboard

The keyboard is good quality. I went with the blank keycaps for style points and to encourage memorizing my keyboard layout, which I’m happy with after some initial hurdles learning how the F-keys function.

Fingerprint reader

The power button is also a fingerprint reader! It works with out-of-box drivers and seldom fails to register my fingerprint. That’s all I could ask for, really.

Partitioning and Encryption

The system has a TPM so I’ve been able to do some interesting things, like configure the TPM to store my dm-crypt keys.

I use a configuration where /boot and /boot/efi are on separate physical partitions and then there’s a giant /dev/nvme0n1p2 partition housing LUKS. Within LUKS is LVM, with the first vg housing (encrypted) swap and the second divided into /home, /var/ and / btrfs subvolumes.

$ lsblk
NAME          MAJ:MIN RM  SIZE RO TYPE  MOUNTPOINTS
nvme0n1       259:0    0  1.8T  0 disk
├─nvme0n1p1   259:1    0    2G  0 part  /boot
├─nvme0n1p2   259:2    0  1.8T  0 part
│ └─cryptroot 253:0    0  1.8T  0 crypt
│   ├─vg-swap 253:1    0   32G  0 lvm   [SWAP]
│   └─vg-main 253:2    0  1.8T  0 lvm   /home
│                                       /var
│                                       /
└─nvme0n1p3   259:3    0    2G  0 part  /boot/efi

Secure Boot

For Secure Boot I am using systemd-ukify, sbsign, and pacman hooks.

# sbctl status
Installed:      ✓ sbctl is installed
Owner GUID:     9df5ea07-e33e-4361-9c03-51d46b0dd9ed
Setup Mode:     ✓ Disabled
Secure Boot:    ✓ Enabled
Vendor Keys:    none

To get here you need to generate keys:

# sbctl create-keys

This creates keys in /var/lib/sbctl/keys/:

# ls /var/lib/sbctl/keys
db  KEK  PK

Then you reboot, put the secure-boot in setup mode (which allows writing keys), and enroll your keys with sbctl enroll-keys.

# cat /etc/pacman.d/hooks/90-secureboot-systemd-update.hook
[Trigger]
Operation = Upgrade
Type = Package
Target = systemd # systemd-boot is part of the systemd package

[Action]
Description = Updating and signing systemd-boot on ESP for Secure Boot...
When = PostTransaction
Exec = /usr/local/bin/update-signed-bootloader
NeedsTargets

# cat /var/lib/sbctl/files.json
{
    "/boot/efi/EFI/BOOT/BOOTX64.EFI": {
        "file": "/boot/efi/EFI/BOOT/BOOTX64.EFI",
        "output_file": "/boot/efi/EFI/BOOT/BOOTX64.EFI"
    },
    "/boot/efi/EFI/Linux/arch-secure.efi": {
        "file": "/boot/efi/EFI/Linux/arch-secure.efi",
        "output_file": "/boot/efi/EFI/Linux/arch-secure.efi"
    },
    "/boot/efi/EFI/Linux/arch-troubleshoot.efi": {
        "file": "/boot/efi/EFI/Linux/arch-troubleshoot.efi",
        "output_file": "/boot/efi/EFI/Linux/arch-troubleshoot.efi"
    },
    "/boot/efi/EFI/systemd/systemd-bootx64.efi": {
        "file": "/boot/efi/EFI/systemd/systemd-bootx64.efi",
        "output_file": "/boot/efi/EFI/systemd/systemd-bootx64.efi"
    }
}

[Trigger]
Operation = Upgrade
Type = Package
Target = linux
Target = amd-ucode # Add other relevant packages like 'systemd' if its updates affect initramfs build

[Action]
Description = Rebuilding UKIs and signing with sbctl...
When = PostTransaction
Exec = /usr/local/bin/rebuild-ukis-for-sbctl.sh
NeedsTargets

TPM decryption

Once you have a standard dm-crypt/LUKS configuration you can enroll it in the TPM. First ensure you have a TPM.

# ls /dev/tpm*

Then you can enroll the device with:

# systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0,4,6,7 /dev/nvme0n1p2

You’ll note I specify --tpm2-pcrs=0,4,6,7 there. I do that because I want to measure the platform-code, boot-loader-code, host-platform, and secure-boot-policy and only release keys from the TPM if all match. This is an agressive config; most people only pick 7.

You’ll see the TPM PCR unlock attached to our drive:

# cryptsetup luksDump /dev/nvme0n1p2 | grep pcr | head
  0: systemd-tpm2
        tpm2-hash-pcrs:   7
        tpm2-pcr-bank:    sha256
        tpm2-pubkey:
        tpm2-pubkey-pcrs:
        tpm2-primary-alg: ecc

For more on how to configure this, see ArchWiki: Encrypting an entire System#Luks on a partition with TPM2 and Secure Boot.

Note that the TPM will only grant access to the decryption key if the Secure Boot chain does not show signs of tampering.

Fingerprint Unlock

First install fprint with pacman. Then add it to /etc/pam.d/system-auth:

# diff -c10 /etc/pam.d/system-auth.bk /etc/pam.d/system-auth
*** /etc/pam.d/system-auth.bk   2025-05-01 04:34:54.821598714 -0400
--- /etc/pam.d/system-auth      2025-04-29 23:22:27.302944835 -0400
***************
*** 1,16 ****
--- 1,17 ----
  #%PAM-1.0

  auth       required                    pam_faillock.so      preauth
  # Optionally use requisite above if you do not want to prompt for the password
  # on locked accounts.
  -auth      [success=2 default=ignore]  pam_systemd_home.so
+ auth       sufficient                  pam_fprintd.so
  auth       [success=1 default=bad]     pam_unix.so          try_first_pass nullok
  auth       [default=die]               pam_faillock.so      authfail
  auth       optional                    pam_permit.so
  auth       required                    pam_env.so
  auth       required                    pam_faillock.so      authsucc
  # If you drop the above call to pam_faillock.so the lock will be done also
  # on non-consecutive authentication failures.

  -account   [success=1 default=ignore]  pam_systemd_home.so
  account    required                    pam_unix.so

Now use fprintd-enroll (optionally with -f right-middle-finger and so forth) to enroll your fingers, which are stored in /var/lib/fprint. You can now login and sudo with your fingerprint.

home-manager entrypoint

I have moved to Nix Flakes for my home-manager entrypoint. Flakes are still new to me, but they solve reproducibility issues present with regular Nix.

{
  description = "My full system config (Arch + Home Manager)";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
    home-manager = {
      url = "github:nix-community/home-manager";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs = { self, nixpkgs, home-manager, ... }: let
    system = "x86_64-linux";
    username = builtins.getEnv "USER";
    homeDirectory = builtins.getEnv "HOME";

    secrets = {
      # ...
    };
  in {
    homeConfigurations.${username} = home-manager.lib.homeManagerConfiguration {
      pkgs = import nixpkgs {
        inherit system;
      };
      modules = [
        ../home-manager/arch.nix
        {
          programs.home-manager.enable = true;
          home.stateVersion = "24.11";
        }
      ];
      extraSpecialArgs = {
        inherit system;
        secrets = secrets;
        username = username;
        homeDirectory = homeDirectory;
      };
    };
  };
}

I know that, in principle, I should have multiple entrypoints here and condition them based on the machine (so I use the same Flake for Darwin and Arch). I’m not there yet.

I run my home-manager setup with this:

#!/usr/bin/env bash

SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )

. "$SCRIPT_DIR/secrets.sh"
export NIXPKGS_ALLOW_UNFREE=1
nix run github:nix-community/home-manager -- switch --impure --flake "${SCRIPT_DIR}"

It requires --impure because it takes env vars as inputs, such as USER, HOME, USER_EMAIL. I don’t want my user email cleartext in my dotfiles (though in practice, people can steal it from GitHub).

ollama

I’m currently using nix-shell to run ollama. I had a hell of a time getting this to work with the Radeon 860M so here are my steps.

First, use rocminfo to get some magic variables:

$ nix-shell -p "rocmPackages.rocminfo" --run "rocminfo" | grep "gfx"
  Name:                    gfx1152
        Name:                    amdgcn-amd-amdhsa--gfx1152

Now set the env vars with the magic make rocm work values, the first of which is taken from rocminfo:

#!/usr/bin/env bash

OLLAMA_PACKAGE=ollama-rocm
ENV_VARS='HCC_AMDGPU_DEVICES=gfx1152 HSA_OVERRIDE_GFX_VERSION="11.0.0" ROCR_VISIBLE_DEVICES=0'
COMMAND="$ENV_VARS ollama serve"
echo "running '${COMMAND}'"
echo nix-shell -p "${OLLAMA_PACKAGE}" --command "${COMMAND}"

If it works, you will see output lines like this, indicating rocm is working:

time=2025-05-06T23:21:04.985-04:00 level=INFO source=types.go:130 msg="inference compute" id=0 library=rocm variant="" compute=gfx1152 driver=0.0 name=1002:1114 total="8.0 GiB" available="7.9 GiB"

If you get an error, like msg=unsupported Radeon iGPU detected skipping" id=0 total="512.0 MiB" then this means you need to reboot to your bootloader and change the iGPU settings to allocate static vRAM to your GPU. Sorry. I gave 8 GiB to mine, which is stolen permanently from RAM.