On Thu, 5 Nov 2026 at 11:39, Tycho Kirchner <[email protected]> wrote: > > Hi Ilias, > > Am 05.11.26 um 10:35 schrieb Ilias Apalodimas: > > > > Thanks for the update. You havent appended any of my reviewed-by on > > previous patches. > > I think this looks good overall now. Can you send a v3 with my tags? > > Sorry for that. As this is the first time I submit to u-boot I'm am not > so much into it yet (;
No worries. It just makes our lives a lot easier. Thanks /Ilias > > Going to send the v3 soon! > > Best Regards, Tycho > > > > > > On Wed, 4 Nov 2026 at 11:42, Tycho Kirchner <[email protected]> wrote: > >> > >> A TPM implementing more PCR banks than U-Boot knows algorithms for is > >> currently rejected by tpm2_get_pcr_info(), even if the unknown banks > >> are inactive. Ours implements six banks, including SHA3-384: > >> > >> tpm2_get_pcr_info: too many pcrs: 6 > >> > >> Once this limit is lifted (patch 2), the existing code for deactivating > >> unsupported banks with CONFIG_TPM_PCR_ALLOCATE turns out not to work: > >> > >> - the result of TPM2_PCR_Allocate (allocationSuccess) is ignored, so a > >> refused allocation goes unnoticed (patch 1) > >> - active banks with algorithms not listed in hash_algo_list at all are > >> never detected (patch 3) > >> - the fallback in tpm2_pcr_extend() deactivates *all* banks and does not > >> reset the board (patch 4) > >> > >> Patch 5 deactivates the unsupported banks in tpm2_startup() already, if > >> the TPM is actually started there, so that this happens before anything > >> gets measured, also for users which do not go through > >> tcg2_measurement_init() or the EFI TCG2 protocol. Note that with > >> CONFIG_TPM_PCR_ALLOCATE enabled, this lets tpm2_startup() fail if the > >> unsupported banks cannot be deactivated. The rationale is that enabling > >> the option asks U-Boot to manage the banks, so failing early seems > >> preferable to failing at the first PCR extend. > >> > >> Tested on a downstream U-Boot based on v2025.04 with a TPM implementing > >> six PCR banks, with the unsupported banks both inactive and active. > >> Build- and unit-tested (ut dm tpm, ut lib) on sandbox against main. > >> > >> Changes in v2: > >> - 5/5: deactivate the unsupported banks in tpm2_startup() instead of > >> tpm2_auto_start(), and only if TPM2_Startup(TPM2_SU_CLEAR) succeeded, > >> i.e. not if an earlier boot stage already started the TPM, and not > >> for TPM2_SU_STATE (Ilias) > >> - rebased onto current main > >> > >> v1: > >> https://lore.kernel.org/u-boot/[email protected]/ > >> > >> Tycho Kirchner (5): > >> tpm: check allocationSuccess of TPM2_PCR_Allocate > >> tpm: allow TPMs with more banks than U-Boot knows algorithms for > >> tpm: detect active banks with algorithms unknown to U-Boot > >> tpm: deactivate only unsupported banks before PCR extend > >> tpm: deactivate unsupported banks in tpm2_startup() > >> > >> lib/tpm-v2.c | 76 ++++++++++++++++++++++++++++++++++++++++++++-------- > >> 1 file changed, 65 insertions(+), 11 deletions(-) > >> > >> -- > >> 2.47.3 > >> > > -- > M.Sc. Tycho Kirchner > > emlix GmbH > Headquarters: Berliner Str. 12, 37073 Göttingen, Germany > Phone +49 (0)551 30664-0, e-mail [email protected] > District Court of Göttingen, Registry Number HR B 3160 > Managing Directors: Heike Jordan, Dr. Uwe Kracke > VAT ID No. DE 205 198 055 > Office Berlin: Panoramastr. 1, 10178 Berlin, Germany > Office Bonn: Bachstr. 6, 53115 Bonn, Germany > Office München: Am Knie 16, 81241 München, Germany > http://www.emlix.com > > emlix - your embedded Linux partner >
