tpm2_get_pcr_info() rejects a TPM that implements more PCR banks than
U-Boot has entries in hash_algo_list. A TPM with six banks, for
instance, fails with
tpm2_get_pcr_info: too many pcrs: 6
Error: -90
even if all banks with an algorithm unknown to U-Boot are inactive.
Each bank corresponds to one hash algorithm, but only the *active*
banks need to be supported for measured boot. This is already checked
elsewhere: tpm2_check_active_banks() and tpm2_scan_masks() detect active
unsupported banks and, with CONFIG_TPM_PCR_ALLOCATE, deactivate them.
These checks are never reached, however, because tpm2_get_pcr_info()
fails beforehand.
Only limit the number of banks to the size of the selection array
(TPM2_NUM_PCR_BANKS), which is what the parsing code requires.
Fixes: 97707f12fdab ("tpm: Support boot measurements")
Signed-off-by: Tycho Kirchner <[email protected]>
---
lib/tpm-v2.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c
index 137bbbd9593..43ca54621d8 100644
--- a/lib/tpm-v2.c
+++ b/lib/tpm-v2.c
@@ -702,10 +702,12 @@ int tpm2_get_pcr_info(struct udevice *dev, struct
tpml_pcr_selection *pcrs)
pcrs->count = get_unaligned_be32(response);
/*
- * check against the supported algorithms in hash_algo_list,
- * instead of TPM2_NUM_PCR_BANKS
+ * The TPM may implement banks with algorithms unknown to U-Boot.
+ * Only the active ones must be supported, which is checked by
+ * tpm2_check_active_banks() and tpm2_scan_masks(), so accept up to
+ * TPM2_NUM_PCR_BANKS here.
*/
- if (pcrs->count > ARRAY_SIZE(hash_algo_list) || pcrs->count < 1) {
+ if (pcrs->count > ARRAY_SIZE(pcrs->selection) || pcrs->count < 1) {
printf("%s: too many pcrs: %u\n", __func__, pcrs->count);
return -EMSGSIZE;
}
--
2.47.3
