With CONFIG_TPM_PCR_ALLOCATE, active banks with unsupported algorithms are only deactivated by tcg2_log_prepare_buffer() or, as a fallback, when a PCR is extended. Users of the TPM which do not go through tcg2_measurement_init() therefore only notice the unsupported banks when measuring, e.g.
tcg2_create_digest: unsupported algorithm 28 Cannot extend PCRs if all the TPM enabled algorithms are not supported Deactivate them in tpm2_auto_start() already, before anything gets measured. If this fails, e.g. because the TPM refuses the allocation or no supported bank would remain active, return an error. The rationale is that with CONFIG_TPM_PCR_ALLOCATE enabled, U-Boot is expected to manage the banks, so fail early instead of at the first PCR extend. This is in line with the TPM_PCR_ALLOCATE help text, which does not specify at which point during boot the allocation takes place. Signed-off-by: Tycho Kirchner <[email protected]> --- lib/tpm-v2.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c index 18ec9eb960d..bd049fed748 100644 --- a/lib/tpm-v2.c +++ b/lib/tpm-v2.c @@ -232,6 +232,18 @@ u32 tpm2_auto_start(struct udevice *dev) if (rc) return rc; + /* + * Early deactivate active banks with unsupported algorithms. On success, + * this resets the board. + */ + if (IS_ENABLED(CONFIG_TPM_PCR_ALLOCATE)) { + rc = tpm2_activate_banks(dev, 0); + if (rc) { + log_err("TPM: failed to deactivate unsupported banks\n"); + return rc; + } + } + return tpm2_update_active_banks(dev); } -- 2.47.3
