Since a couple of days the pcrlock subtest fails intermittently on
debian-testing and arch CI runs (unrelated PRs: #44152 and others), with
"systemd-pcrlock is-supported" printing "partial" and exiting with 97,
i.e. TPM2_SUPPORT_FIRMWARE is missing.
The console output of the affected boots shows that the TPM already
breaks down while the firmware runs:
EFI stub: WARNING: Failed to measure data for event 1: 0x8000000000000007
EFI stub: WARNING: Failed to measure data for event 0: 0x8000000000000007
i.e. the TCG2 protocol is there, but all measurements fail with
EFI_DEVICE_ERROR, systemd-stub reports no active PCR banks in
LoaderTpm2ActivePcrBanks, and ConditionSecurity=measured-os is hence
false for the whole boot. pcrlock can't do anything useful in that case,
so let's skip the subtest instead of failing, and log what
"systemd-analyze has-tpm2" reports so that this remains visible.
(cherry picked from commit 09fdbf4d715e962cc13fd678760754e59d0aeeaf)
Lennart Poettering
1d40ff7a67