On Fri, 6 Nov 2026 at 11:51, Tycho Kirchner <[email protected]> wrote: > > Hi Ilias, > > Am 06.11.26 um 09:53 schrieb Ilias Apalodimas: > > > I don't mind keeping it, but if the previous boot stage supports more > > algorithms than U-Boot, this is actively blocked in the TCG code, > > IIRC. > > Right, with an event log tcg2_log_parse() rejects algorithms unknown > to U-Boot, so the fallback is not reached there. It is meant for users > which do not go through tcg2_log_prepare_buffer() at all, e.g. a custom > measurement implementation on top of lib/tpm-v2.c (my case) or, more > importantly "tpm2 pcr_extend", if an earlier stage already started the > TPM.
Ah yes, fair point. I keep forgetting that boards might start the TPM earlier properly. Ok we need to keep this check indeed. Cheers /Ilias > > Thanks for the review and testing! > > Tycho > > > > Reviewed-by: Ilias Apalodimas <[email protected]> > > Tested-by: Ilias Apalodimas <[email protected]> > >> TPM2_SU_STATE, used by tpm_resume(), is left alone. > >> > >> If the deactivation fails, e.g. because the TPM refuses the allocation > >> or no supported bank would remain active, return an error. With > >> CONFIG_TPM_PCR_ALLOCATE enabled, U-Boot is expected to manage the banks, > >> so fail early instead of at the first PCR extend. > >> > >> Signed-off-by: Tycho Kirchner <[email protected]> > >> --- > >> lib/tpm-v2.c | 13 +++++++++++++ > >> 1 file changed, 13 insertions(+) > >> > >> diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c > >> index 18ec9eb960d..6370b97a7d4 100644 > >> --- a/lib/tpm-v2.c > >> +++ b/lib/tpm-v2.c > >> @@ -201,6 +201,19 @@ u32 tpm2_startup(struct udevice *dev, bool bon, enum > >> tpm2_startup_types mode) > >> if ((ret && ret != TPM2_RC_INITIALIZE) || !bon) > >> return ret; > >> > >> + /* > >> + * Only the boot stage which actually starts the TPM deactivates > >> active > >> + * banks with unsupported algorithms. On success, this resets the > >> board. > >> + */ > >> + if (IS_ENABLED(CONFIG_TPM_PCR_ALLOCATE) && !ret && > >> + mode == TPM2_SU_CLEAR) { > >> + ret = tpm2_activate_banks(dev, 0); > >> + if (ret) { > >> + log_err("TPM: failed to deactivate unsupported > >> banks\n"); > >> + return ret; > >> + } > >> + } > >> + > >> return tpm2_update_active_banks(dev); > >> } > >> > >> -- > >> 2.47.3 > >> > > -- > M.Sc. Tycho Kirchner > > emlix GmbH > Headquarters: Berliner Str. 12, 37073 Göttingen, Germany > Phone +49 (0)551 30664-0, e-mail [email protected] > District Court of Göttingen, Registry Number HR B 3160 > Managing Directors: Heike Jordan, Dr. Uwe Kracke > VAT ID No. DE 205 198 055 > Office Berlin: Panoramastr. 1, 10178 Berlin, Germany > Office Bonn: Bachstr. 6, 53115 Bonn, Germany > Office München: Am Knie 16, 81241 München, Germany > http://www.emlix.com > > emlix - your embedded Linux partner >
