From f08bfdbf3d4e712a7de9d1c27c322f09e7092a33 Mon Sep 17 00:00:00 2001 From: Alberto Planas Date: Mon, 14 Sep 2026 13:21:32 +0200 Subject: [PATCH] tpm2-util: retry NvPCR initialization when PCR values keep changing tpm2_nvpcr_initialize() already retries the initializing write when tpm2_extend_nvpcr_nv_index() reports that PCR values changed under its feet, which the comment there attributes to IMA measurements performed by the kernel. The policy session that write needs is opened in the same loop, and a PCR extended while that policy is submitted makes tpm2_policy_pcr() return -EUCLEAN, which was propagated as a hard failure instead. That is the same transient condition observed one step earlier, so let the loop absorb it too. Signed-off-by: Alberto Planas --- src/shared/tpm2-util.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c index 98f3d9b5ba..1c5fffa8c8 100644 --- a/src/shared/tpm2-util.c +++ b/src/shared/tpm2-util.c @@ -9296,6 +9296,13 @@ int tpm2_nvpcr_initialize( signature_json, &authorize_policy, &policy_session); + if (r == -EUCLEAN) { + /* A PCR was extended while we submitted the policy, so this session is unusable. + * Same situation as below, just observed while building the policy rather than + * while writing. */ + if (i > 0) + continue; + } if (r < 0) return r;