EFI stub: WARNING: Failed to measure data for event 1: 0x800000000000000b

guckuck · September 2, 2025, 1:33pm

Since today or yesterday, I am not sure, I get the warning after the GRUB-menu:

EFI stub: WARNING: Failed to measure data for event 1: 0x800000000000000b

Yesterday, I updated the BIOS (ASUS Zenbook UX3405MA to version V311).
Today, I deleted some packages and then restore everything with a snapper-rollback.

I think, I don’t saw this messages after BIOS-Upgrade, but I am not sure.

Secure Boot is off. When I switch SecureBoot on, the message is gone.

The system works within normal parameters (except this message).

Any ideas?

Best regards
Kay

arvidjaar · September 2, 2025, 2:06pm

Run

tpm2_eventlog /sys/kernel/security/tpm0/binary_bios_measurements

and upload full output to the https://paste.opensuse.org/

guckuck · September 2, 2025, 2:37pm

Den Befehl gibt es nicht.

susejunky · September 2, 2025, 2:46pm

Doch …

 # tpm2_eventlog /sys/kernel/security/tpm0/binary_bios_measurements
---
version: 1
events:
- EventNum: 0
...
#

es gibt ihn.

Allerdings ohne ein Leerzeichen zwischen “event” und “log” und er muss als “root” ausgeführt werden.

Und …

Please be aware that this is the English section of the forum!

guckuck · September 2, 2025, 3:04pm

Sorry, on my system, there was no tpm2_eventlog. First, I had to install tpm2.0-tools.

https://paste.opensuse.org/pastes/0f5470a67f47

Sorry for the german.

arvidjaar · September 2, 2025, 5:25pm

Then install it.

cnf tpm2_eventlog

If you do not want to install, upload the file somewhere (I do not think susepaste supports binary uploads).

guckuck · September 2, 2025, 6:22pm

Ähm, I already done this, see above.

arvidjaar · September 2, 2025, 6:49pm

The event log is incomplete - there are no events related to kernel loading. The status 0x800000000000000b is EFI_VOLUME_FULL which according to the TCG2 specification means “The extend operation occurred, but the event could not be
written to one or more event logs.”. This matches the previous observation. Apparently there are too many events and firmware fails to store them. You are using grub which logs every command in the grub.cfg.

As long as you do not use TPM it can be ignored.

penguinrapper · September 2, 2025, 7:02pm

i was having the same issue, the fix i found was going into the BIOS and turning on secure boot then in the key managent setting of secure boot clicking the reset to setup mode option then turning secure boot off and then save and exit, if this does not work try restore to default key option.

guckuck · September 3, 2025, 3:52pm

Thanks for your hints. Today, the message is gone. I haven’t changed anything, at least not consciously.

penguinrapper · September 3, 2025, 4:46pm

Did you updated any anything??

guckuck · September 3, 2025, 5:22pm

No, not consciously. In the morning I worked a few hours with Windows. Later, I switched back to openSUSE. I noticed the missing warning-message.

Best regards
Kay

jjis · September 5, 2025, 1:06pm

I too have just started getting this message after recently updating my BIOS & also changing my PSU, although I don’t think that should be causing this. You seem to be on the right lines in terms of Secure Boot potentially being the issue. I think my Opensuse is set to secure boot, and the BIOS secure boot setting is set to Other OS as I have a dual boot set up with windows on a separate SSD.

I alos noticed when booting into Windows that that was complaining about some EFI file being missing or some such.

So I’m wondering if I need to change the Secure boot to the EFI setting which is for windows, although I’m not sure if Opensuse can handle windows / EFI secure boot? Although I seem to think there are some Windows Key things that get periodically updated.

Not sure this advances us towards a solution but searching this issue - seems to throw up BIOS & Secure boot as issues / solutions.

Do any more experienced user or admins know the correct setting with Windows & Opensuse together is EFI Secure boot OK to use - can Opensuse handle it?
Sorry more questions than answers.

malcolmlewis · September 5, 2025, 1:18pm

@jjis should be no issues, your talking about the UEFI db updates, which should all be taken care off via fwupd. So what does fwupdmgr security show?

jjis · September 5, 2025, 1:22pm

that shows :

(v2.0.14)

HSI-1
✔ SMM locked down:               Locked
✔ BIOS firmware updates:         Enabled
✔ Fused platform:                Locked
✔ Supported CPU:                 Valid
✔ TPM empty PCRs:                Valid
✔ TPM v2.0:                      Found
✔ UEFI bootservice variables:    Locked
✔ UEFI platform key:             Valid

HSI-2
✔ IOMMU:                         Enabled
✔ Platform debugging:            Locked
✔ TPM PCR0 reconstruction:       Valid
✘ SPI write protection:          Disabled

HSI-3
✔ CET Platform:                  Supported
✘ SPI replay protection:         Not supported
✘ Pre-boot DMA protection:       Disabled
✘ Suspend-to-idle:               Disabled
✘ Suspend-to-ram:                Enabled

HSI-4
✔ SMAP:                          Enabled
✘ Processor rollback protection: Disabled
✘ Encrypted RAM:                 Not supported

Runtime Suffix -!
✔ CET OS Support:                Supported
✔ fwupd plugins:                 Untainted
✔ UEFI db:                       Valid
✘ Linux kernel lockdown:         Disabled
✘ Linux swap:                    Unencrypted
✘ Linux kernel:                  Tainted
✘ UEFI secure boot:              Disabled

This system has HSI runtime issues.
 » https://fwupd.github.io/hsi.html#hsi-runtime-suffix

Host Security Events
  2025-08-27 17:27:20:  ✔ TPM v2.0 changed: Not found → Found
  2025-05-11 10:33:48:  ✔ The UEFI certificate store is now up to date
  2024-12-24 06:57:33:  ✔ CET OS Support changed: Not supported → Supported
  2024-11-17 19:21:05:  ✘ CET OS Support changed: Supported → Not supported
  2024-10-01 05:30:51:  ✔ CET OS Support changed: Not supported → Supported

Upload these anonymous results to the Linux Vendor Firmware Service to help other users? [y|N]: y

malcolmlewis · September 5, 2025, 1:26pm

@jjis so the database is “Valid” and as you can see Secure Boot is disabled, you have a tainted kernel… Nvidia, VirtualBox modules?

jjis · September 5, 2025, 1:30pm

Yes I have Nvidia & it is working with Prime & switcheroo etc. not sure that makes a difference. The link in the output suggested various things wrong etc. But my system didn’t complain about this before, although it was acting weird when my PSU was playing up just before I changed it.

malcolmlewis · September 5, 2025, 1:53pm

@jjis the only thing I would suggest is checking the system BIOS for SPI items, maybe switch to using zram for swap that will change the runtime suffix to encrypted. Else it looks fine to me…

jjis · September 5, 2025, 2:10pm

SPI ? And I would need to reformat the swap then to do that presumably rather than just changing the suffix / file type? Would it be ok to use UEFI secure boot - would Opensuse still work with that ?- although you didn’t suggest that.

malcolmlewis · September 5, 2025, 2:30pm

@jjis as per the output, SPI is Disabled in HSI-2.

No, if you use zram, then there is no swap partiton needed.

Secure boot works fine on openSUSE, if using third party kernel modules, eg Nvidia, then they need to be signed and accepted at the MOK screen.

This is from an Intel System (Dell Micro 3080) running openSUSE Leap 16.0 RC;

fwupdmgr security
Host Security ID: HSI:1 (v2.0.6)

HSI-1
✔ BIOS firmware updates:         Enabled
✔ csme manufacturing mode:       Locked
✔ csme override:                 Locked
✔ csme v0:14.5.57.2316:          Valid
✔ Platform debugging:            Disabled
✔ SPI write:                     Disabled
✔ SPI lock:                      Enabled
✔ SPI BIOS region:               Locked
✔ Supported CPU:                 Valid
✔ TPM empty PCRs:                Valid
✔ TPM v2.0:                      Found
✔ UEFI bootservice variables:    Locked
✔ UEFI platform key:             Valid
✔ UEFI secure boot:              Enabled

HSI-2
✔ Intel BootGuard ACM protected: Valid
✔ Intel BootGuard:               Enabled
✔ Intel BootGuard OTP fuse:      Valid
✔ Intel BootGuard verified boot: Valid
✔ Intel GDS mitigation:          Enabled
✔ IOMMU:                         Enabled
✔ Platform debugging:            Locked
✔ TPM PCR0 reconstruction:       Valid
✘ BIOS rollback protection:      Disabled

HSI-3
✔ Intel BootGuard error policy:  Valid
✔ Pre-boot DMA protection:       Enabled
✘ CET Platform:                  Not supported
✘ Suspend-to-idle:               Disabled
✘ Suspend-to-ram:                Enabled

HSI-4
✔ SMAP:                          Enabled
✘ Encrypted RAM:                 Not supported

Runtime Suffix -!
✔ fwupd plugins:                 Untainted
✔ Linux kernel lockdown:         Enabled
✔ Linux swap:                    Encrypted
✔ Linux kernel:                  Untainted