Message during boot and something else

[woozy]

Hello, I have a message during boot.

As soon as i set the second password Disk/Swap.

• The first password clean field - No error message.
• After successfully obtaining the second password i get this message:

INFO: No PCR 15 validation

To continue with several login attempts to stop at the fourth.
I use manual way to log in user/pass.

Both of these things came to me as soon as i installed the current kernel 6.15.8-1-default I haven’t had anything like this before.

Here is a video (expires in 2 days since this post) demonstration.

Operating System: openSUSE Tumbleweed 20250810
Kernel Version: 6.15.8-1-default (64-bit)
BootMGR: openSUSE Boot Manager (systemd-boot) - shim.efi
Init: systemd 257.7+suse.22.g835af70f4e

[dcurtisfra]

@woozy:

Please check if, the systemd Journal has an entry similar to this –

kernel: PM: hibernation: the secret key is invalid

---

If, there’s something similar to that then –

 # echo 1 > /sys/firmware/efi/secret-key/regen
 # systemctl reboot

[woozy]

Hello dcurtisfra, thanks for coming out.

No i don’t have any kernel: PM: hibernation: the secret key is invalid from journalctl.

# journalctl -b | grep invalid
Aug 11 16:23:13 tumbleweed kernel: DMAR-IR: Queued invalidation will be enabled to support x2apic and Intr-remapping.
Aug 11 16:23:13 tumbleweed kernel: DMAR: dmar0: Using Queued invalidation
Aug 11 16:23:13 tumbleweed kernel: DMAR: dmar1: Using Queued invalidation
Aug 11 16:23:14 tumbleweed kernel: nvme nvme0: missing or invalid SUBNQN field.
Aug 11 16:25:21 tumbleweed kded6[2837]: QDBusObjectPath: invalid path "/modules/wpad-detector"
Aug 11 16:25:21 tumbleweed kded6[2837]: kf.dbusaddons: The kded module name "wpad-detector" is invalid!
Aug 11 16:25:21 tumbleweed kded6[2837]: QDBusObjectPath: invalid path "/modules/oom-notifier"
Aug 11 16:25:21 tumbleweed kded6[2837]: kf.dbusaddons: The kded module name "oom-notifier" is invalid!
Aug 11 16:25:21 tumbleweed kded6[2837]: QDBusObjectPath: invalid path "/modules/plasma-session-shortcuts"
Aug 11 16:25:21 tumbleweed kded6[2837]: kf.dbusaddons: The kded module name "plasma-session-shortcuts" is invalid!
# journalctl -b | grep hibernation
Aug 11 16:23:13 tumbleweed kernel: PM: hibernation: Registered nosave memory: [mem 0x00000000-0x00000fff]
Aug 11 16:23:13 tumbleweed kernel: PM: hibernation: Registered nosave memory: [mem 0x0009e000-0x0009efff]
Aug 11 16:23:13 tumbleweed kernel: PM: hibernation: Registered nosave memory: [mem 0x000a0000-0x000fffff]
Aug 11 16:23:13 tumbleweed kernel: PM: hibernation: Registered nosave memory: [mem 0x40000000-0x403fffff]
Aug 11 16:23:13 tumbleweed kernel: PM: hibernation: Registered nosave memory: [mem 0x841e9000-0x841eafff]
Aug 11 16:23:13 tumbleweed kernel: PM: hibernation: Registered nosave memory: [mem 0x9b061000-0x9b27ffff]
Aug 11 16:23:13 tumbleweed kernel: PM: hibernation: Registered nosave memory: [mem 0xa7ece000-0xafffefff]
Aug 11 16:23:13 tumbleweed kernel: PM: hibernation: Registered nosave memory: [mem 0xb0000000-0xb7ffffff]
Aug 11 16:23:13 tumbleweed kernel: PM: hibernation: Registered nosave memory: [mem 0xb8a00000-0xffffffff]
Aug 11 16:23:13 tumbleweed kernel: Lockdown: swapper/0: hibernation is restricted; see man kernel_lockdown.7
Aug 11 16:25:21 tumbleweed kernel: Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
Aug 11 16:25:21 tumbleweed kernel: Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
Aug 11 16:25:21 tumbleweed kernel: Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
Aug 11 16:25:22 tumbleweed kernel: Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
Aug 11 16:25:22 tumbleweed kernel: Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
Aug 11 16:25:22 tumbleweed kernel: Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
Aug 11 16:25:22 tumbleweed kernel: Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
Aug 11 16:25:22 tumbleweed kernel: Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
Aug 11 16:25:22 tumbleweed kernel: Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
# journalctl -b | grep secret
Aug 11 16:29:25 tumbleweed systemd[2678]: Created slice Slice /app/dbus-:1.2-org.kde.secretservicecompat.
Aug 11 16:29:25 tumbleweed systemd[2678]: Started dbus-:1.2-org.kde.secretservicecompat@0.service.
Aug 11 16:29:26 tumbleweed kwalletd6[3652]: qt.dbus.integration: QDBusConnection: name 'org.kde.secretservicecompat' had owner '' but we thought it was ':1.52'

[knurpht]

Ah, you are one of the very few that still uses hibernation. Please look at the journal after a cold boot.

[woozy]

Hello, I don’t use hibernation, i have Desktop Tower, i don’t need this service because i leave my PC 24/7 running constantly.

In fact, every time i do a new installation i turn those off as unwanted for me /etc/systemd/sleep.conf.d/disable-sleep.conf

[Sleep]
AllowSuspend=no
AllowHibernation=no
AllowHybridSleep=no
AllowSuspendThenHibernate=on

On my cold boot i used journalctl --list-boots I took out the last one IDX “0”. Hope this helps.

https://paste.opensuse.org/pastes/17efd0f8beb3

Edit: I made sure that i don’t have Hibernation actived.

[knurpht]

OK, guess I thought wrong

[marel]

Can you try booting with measure-pcr-validator.ignore=yes

Cannot use TPM 2.0 to decrypt LUKS encrypted root filesystem due to unmet condition checks

I’ve installed opensuse tumbleweed on bare metal using the usual btrfs layout, and luks encryption (but no lvm). I followed this guide also: Quickstart in Full Disk Encryption with TPM and YaST2 - openSUSE News However when I rebooted after that, the splash screen warned of not being able to measure PCR 15 or something, and I had to add measure-pcr-validator.ignore=yes to be able to boot. After booting, I followed the instructions here: Portal:MicroOS/FDE - openSUSE Wiki, both verbatim and also…

[woozy]

@marel

Can you try booting with measure-pcr-validator.ignore=yes

Please explain where to put measure-pcr-validator.ignore=yes @ /etc/kernel/cmdline? and how to perform update after adding new entry?

[arvidjaar]

I still miss the problem and the actual question.

@woozy

To continue with several login attempts to stop at the fourth.
I use manual way to log in user/pass.

I cannot parse it. Please, try explaining your problem and your question differently.

[woozy]

@arvidjaar

I still miss the problem and the actual question.
I cannot parse it. Please, try explaining your problem and your question differently.

Hello, can’t you see the video?

[arvidjaar]

I do not see anything wrong on your video. And posting video without explanation is not the best way to ask questions.

[woozy]

I tried to explain both of these in writing and video above, my English is not perfect, but i believe it is understandable. Apparently it wasn’t to you, I’m sorry. This message No PCR 15 validation appears on my boot screen.

• INFO: No PCR 15 validation.
  Also…
• I have several promts attempts (5 in a row)

tumbleweed login:
tumbleweed login:
tumbleweed login:
tumbleweed login:
tumbleweed login:

[arvidjaar]

@woozy

This message No PCR 15 validation appears on my boot screen.

You can ignore it. The current sdbootutil always adds tpm2-measure-pcr=yes to the /etc/crypttab and expects it to be present. It is just an informational message. You can add this option yourself or you can exclude measure-pcr dracut module if you do not like it.

@woozy

I have several promts attempts (5 in a row)

That’s normal. There is issue generator that is invoked by udev and triggers agetty reload which redraws the login prompt. There are multiple events so it happens several times.

[woozy]

@arvidjaar

You can ignore it. The current sdbootutil always adds tpm2-measure-pcr=yes to the /etc/crypttab and expects it to be present. It is just an informational message. You can add this option yourself or you can exclude measure-pcr dracut module if you do not like it.

Thank you for explaining, I thought it was something serious, but as you describe it, i will ignore it without making any intervention.

@arvidjaar

That’s normal. There is issue generator that is invoked by udev and triggers agetty reload which redraws the login prompt. There are multiple events so it happens several times.

Okay, this explanation convinces me not to worry too much about this either.

I am continuing and calling it clarified. Thank you for your assistance.