Tycho, Thanks for the update. You havent appended any of my reviewed-by on previous patches. I think this looks good overall now. Can you send a v3 with my tags?
Thanks /Ilias On Wed, 4 Nov 2026 at 11:42, Tycho Kirchner <[email protected]> wrote: > > A TPM implementing more PCR banks than U-Boot knows algorithms for is > currently rejected by tpm2_get_pcr_info(), even if the unknown banks > are inactive. Ours implements six banks, including SHA3-384: > > tpm2_get_pcr_info: too many pcrs: 6 > > Once this limit is lifted (patch 2), the existing code for deactivating > unsupported banks with CONFIG_TPM_PCR_ALLOCATE turns out not to work: > > - the result of TPM2_PCR_Allocate (allocationSuccess) is ignored, so a > refused allocation goes unnoticed (patch 1) > - active banks with algorithms not listed in hash_algo_list at all are > never detected (patch 3) > - the fallback in tpm2_pcr_extend() deactivates *all* banks and does not > reset the board (patch 4) > > Patch 5 deactivates the unsupported banks in tpm2_startup() already, if > the TPM is actually started there, so that this happens before anything > gets measured, also for users which do not go through > tcg2_measurement_init() or the EFI TCG2 protocol. Note that with > CONFIG_TPM_PCR_ALLOCATE enabled, this lets tpm2_startup() fail if the > unsupported banks cannot be deactivated. The rationale is that enabling > the option asks U-Boot to manage the banks, so failing early seems > preferable to failing at the first PCR extend. > > Tested on a downstream U-Boot based on v2025.04 with a TPM implementing > six PCR banks, with the unsupported banks both inactive and active. > Build- and unit-tested (ut dm tpm, ut lib) on sandbox against main. > > Changes in v2: > - 5/5: deactivate the unsupported banks in tpm2_startup() instead of > tpm2_auto_start(), and only if TPM2_Startup(TPM2_SU_CLEAR) succeeded, > i.e. not if an earlier boot stage already started the TPM, and not > for TPM2_SU_STATE (Ilias) > - rebased onto current main > > v1: > https://lore.kernel.org/u-boot/[email protected]/ > > Tycho Kirchner (5): > tpm: check allocationSuccess of TPM2_PCR_Allocate > tpm: allow TPMs with more banks than U-Boot knows algorithms for > tpm: detect active banks with algorithms unknown to U-Boot > tpm: deactivate only unsupported banks before PCR extend > tpm: deactivate unsupported banks in tpm2_startup() > > lib/tpm-v2.c | 76 ++++++++++++++++++++++++++++++++++++++++++++-------- > 1 file changed, 65 insertions(+), 11 deletions(-) > > -- > 2.47.3 >
