Hi Ilias, Am 05.11.26 um 10:35 schrieb Ilias Apalodimas: > > Thanks for the update. You havent appended any of my reviewed-by on > previous patches. > I think this looks good overall now. Can you send a v3 with my tags?
Sorry for that. As this is the first time I submit to u-boot I'm am not so much into it yet (; Going to send the v3 soon! Best Regards, Tycho > > On Wed, 4 Nov 2026 at 11:42, Tycho Kirchner <[email protected]> wrote: >> >> A TPM implementing more PCR banks than U-Boot knows algorithms for is >> currently rejected by tpm2_get_pcr_info(), even if the unknown banks >> are inactive. Ours implements six banks, including SHA3-384: >> >> tpm2_get_pcr_info: too many pcrs: 6 >> >> Once this limit is lifted (patch 2), the existing code for deactivating >> unsupported banks with CONFIG_TPM_PCR_ALLOCATE turns out not to work: >> >> - the result of TPM2_PCR_Allocate (allocationSuccess) is ignored, so a >> refused allocation goes unnoticed (patch 1) >> - active banks with algorithms not listed in hash_algo_list at all are >> never detected (patch 3) >> - the fallback in tpm2_pcr_extend() deactivates *all* banks and does not >> reset the board (patch 4) >> >> Patch 5 deactivates the unsupported banks in tpm2_startup() already, if >> the TPM is actually started there, so that this happens before anything >> gets measured, also for users which do not go through >> tcg2_measurement_init() or the EFI TCG2 protocol. Note that with >> CONFIG_TPM_PCR_ALLOCATE enabled, this lets tpm2_startup() fail if the >> unsupported banks cannot be deactivated. The rationale is that enabling >> the option asks U-Boot to manage the banks, so failing early seems >> preferable to failing at the first PCR extend. >> >> Tested on a downstream U-Boot based on v2025.04 with a TPM implementing >> six PCR banks, with the unsupported banks both inactive and active. >> Build- and unit-tested (ut dm tpm, ut lib) on sandbox against main. >> >> Changes in v2: >> - 5/5: deactivate the unsupported banks in tpm2_startup() instead of >> tpm2_auto_start(), and only if TPM2_Startup(TPM2_SU_CLEAR) succeeded, >> i.e. not if an earlier boot stage already started the TPM, and not >> for TPM2_SU_STATE (Ilias) >> - rebased onto current main >> >> v1: >> https://lore.kernel.org/u-boot/[email protected]/ >> >> Tycho Kirchner (5): >> tpm: check allocationSuccess of TPM2_PCR_Allocate >> tpm: allow TPMs with more banks than U-Boot knows algorithms for >> tpm: detect active banks with algorithms unknown to U-Boot >> tpm: deactivate only unsupported banks before PCR extend >> tpm: deactivate unsupported banks in tpm2_startup() >> >> lib/tpm-v2.c | 76 ++++++++++++++++++++++++++++++++++++++++++++-------- >> 1 file changed, 65 insertions(+), 11 deletions(-) >> >> -- >> 2.47.3 >> -- M.Sc. Tycho Kirchner emlix GmbH Headquarters: Berliner Str. 12, 37073 Göttingen, Germany Phone +49 (0)551 30664-0, e-mail [email protected] District Court of Göttingen, Registry Number HR B 3160 Managing Directors: Heike Jordan, Dr. Uwe Kracke VAT ID No. DE 205 198 055 Office Berlin: Panoramastr. 1, 10178 Berlin, Germany Office Bonn: Bachstr. 6, 53115 Bonn, Germany Office München: Am Knie 16, 81241 München, Germany http://www.emlix.com emlix - your embedded Linux partner
