From 1d40ff7a671efa8852e0734271af9c7e3694ad3c Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 14 Oct 2026 08:58:41 +0200 Subject: [PATCH] TEST-70-TPM2: skip pcrlock subtest if firmware TPM2 support is not available Since a couple of days the pcrlock subtest fails intermittently on debian-testing and arch CI runs (unrelated PRs: #44152 and others), with "systemd-pcrlock is-supported" printing "partial" and exiting with 97, i.e. TPM2_SUPPORT_FIRMWARE is missing. The console output of the affected boots shows that the TPM already breaks down while the firmware runs: EFI stub: WARNING: Failed to measure data for event 1: 0x8000000000000007 EFI stub: WARNING: Failed to measure data for event 0: 0x8000000000000007 i.e. the TCG2 protocol is there, but all measurements fail with EFI_DEVICE_ERROR, systemd-stub reports no active PCR banks in LoaderTpm2ActivePcrBanks, and ConditionSecurity=measured-os is hence false for the whole boot. pcrlock can't do anything useful in that case, so let's skip the subtest instead of failing, and log what "systemd-analyze has-tpm2" reports so that this remains visible. (cherry picked from commit 09fdbf4d715e962cc13fd678760754e59d0aeeaf) --- test/units/TEST-70-TPM2.pcrlock.sh | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/test/units/TEST-70-TPM2.pcrlock.sh b/test/units/TEST-70-TPM2.pcrlock.sh index 084d554cc9..de7004613e 100755 --- a/test/units/TEST-70-TPM2.pcrlock.sh +++ b/test/units/TEST-70-TPM2.pcrlock.sh @@ -17,6 +17,15 @@ if [[ ! -x "${SD_PCREXTEND:?}" ]] || [[ ! -x "${SD_PCRLOCK:?}" ]] || [[ ! -x "${ exit 77 fi +# systemd-pcrlock requires that the firmware measured the boot. Occasionally the TPM breaks down already +# during firmware execution in CI (all TCG2 measurements fail with EFI_DEVICE_ERROR, and systemd-stub +# reports no active PCR banks), in which case we can't test anything here. +if ! systemd-analyze has-tpm2 -q; then + systemd-analyze has-tpm2 ||: + echo "Firmware TPM2 support not available, skipping pcrlock tests" + exit 77 +fi + at_exit() { if [[ $? -ne 0 ]]; then # Dump the event log on fail, to make debugging a bit easier