On Thu, 29 Oct 2026 at 17:09, Tycho Kirchner <[email protected]> wrote: > > Commit e7e166dabf12 ("tpm: PCR allocate during PCR extend to disable > the unsupported algorithms") intends to deactivate active banks with > unsupported algorithms when extending a PCR. However, it calls > tpm2_pcr_allocate() with an algorithm mask of 0, which deactivates > *all* banks, including the supported ones: > > set bank[0] sha1 off > set bank[1] sha256 off > ... > > If the TPM refuses this allocation, nothing changes, and the same > happens again on every boot. If the TPM accepts it, no bank is active > after the next TPM2_Startup, so nothing can be measured on any later > boot either. Moreover, the allocation is changed regardless of > CONFIG_TPM_PCR_ALLOCATE. > > Instead, if CONFIG_TPM_PCR_ALLOCATE is enabled, call > tpm2_activate_banks(), which keeps the supported active banks, > deactivates the others and resets the board. Otherwise, leave the > allocation untouched. In both cases, the extend fails while unsupported > banks are active
This makes sense. Raymond do you remember why tpm2_pcr_allocate() was called? Reviewed-by: Ilias Apalodimas <[email protected]> > > Fixes: e7e166dabf12 ("tpm: PCR allocate during PCR extend to disable the > unsupported algorithms") > Signed-off-by: Tycho Kirchner <[email protected]> > --- > lib/tpm-v2.c | 12 +++++++++--- > 1 file changed, 9 insertions(+), 3 deletions(-) > > diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c > index b727c645d73..18ec9eb960d 100644 > --- a/lib/tpm-v2.c > +++ b/lib/tpm-v2.c > @@ -362,9 +362,15 @@ u32 tpm2_pcr_extend(struct udevice *dev, u32 index, u32 > algorithm, > if (!tpm2_check_active_banks(dev)) { > log_err("Cannot extend PCRs if all the TPM enabled algorithms > are not supported\n"); > > - ret = tpm2_pcr_allocate(dev, 0); > - if (ret) > - return -EINVAL; > + /* > + * Deactivate the unsupported banks. On success this resets > + * the board, since the new allocation only takes effect after > + * the next TPM2_Startup. > + */ > + if (IS_ENABLED(CONFIG_TPM_PCR_ALLOCATE)) > + tpm2_activate_banks(dev, 0); > + > + return -EINVAL; > } > /* > * Fill the command structure starting from the first buffer: > -- > 2.47.3 >
