On Thu, 29 Oct 2026 at 17:09, Tycho Kirchner <[email protected]> wrote: > > tpm2_get_pcr_info() rejects a TPM that implements more PCR banks than > U-Boot has entries in hash_algo_list. A TPM with six banks, for > instance, fails with > > tpm2_get_pcr_info: too many pcrs: 6 > Error: -90 > > even if all banks with an algorithm unknown to U-Boot are inactive. > > Each bank corresponds to one hash algorithm, but only the *active* > banks need to be supported for measured boot. This is already checked > elsewhere: tpm2_check_active_banks() and tpm2_scan_masks() detect active > unsupported banks and, with CONFIG_TPM_PCR_ALLOCATE, deactivate them. > These checks are never reached, however, because tpm2_get_pcr_info() > fails beforehand.
Yep that's a fossil from before dynamic PCR configuration. > > Only limit the number of banks to the size of the selection array > (TPM2_NUM_PCR_BANKS), which is what the parsing code requires. I think the fixes tag can be stripped, and I can do that during the merge. My only concern is that this still won't work until the later patches are applied. But since it didn't work to begin with, I prefer the smaller patches Reviewed-by: Ilias Apalodimas <[email protected]> > > Fixes: 97707f12fdab ("tpm: Support boot measurements") > Signed-off-by: Tycho Kirchner <[email protected]> > --- > lib/tpm-v2.c | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > > diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c > index 137bbbd9593..43ca54621d8 100644 > --- a/lib/tpm-v2.c > +++ b/lib/tpm-v2.c > @@ -702,10 +702,12 @@ int tpm2_get_pcr_info(struct udevice *dev, struct > tpml_pcr_selection *pcrs) > > pcrs->count = get_unaligned_be32(response); > /* > - * check against the supported algorithms in hash_algo_list, > - * instead of TPM2_NUM_PCR_BANKS > + * The TPM may implement banks with algorithms unknown to U-Boot. > + * Only the active ones must be supported, which is checked by > + * tpm2_check_active_banks() and tpm2_scan_masks(), so accept up to > + * TPM2_NUM_PCR_BANKS here. > */ > - if (pcrs->count > ARRAY_SIZE(hash_algo_list) || pcrs->count < 1) { > + if (pcrs->count > ARRAY_SIZE(pcrs->selection) || pcrs->count < 1) { > printf("%s: too many pcrs: %u\n", __func__, pcrs->count); > return -EMSGSIZE; > } > -- > 2.47.3 >
