A TPM implementing more PCR banks than U-Boot knows algorithms for is currently rejected by tpm2_get_pcr_info(), even if the unknown banks are inactive. Ours implements six banks, including SHA3-384:
tpm2_get_pcr_info: too many pcrs: 6 Once this limit is lifted (patch 2), the existing code for deactivating unsupported banks with CONFIG_TPM_PCR_ALLOCATE turns out not to work: - the result of TPM2_PCR_Allocate (allocationSuccess) is ignored, so a refused allocation goes unnoticed (patch 1) - active banks with algorithms not listed in hash_algo_list at all are never detected (patch 3) - the fallback in tpm2_pcr_extend() deactivates *all* banks and does not reset the board (patch 4) Patch 5 deactivates the unsupported banks in tpm2_startup() already, if the TPM is actually started there, so that this happens before anything gets measured, also for users which do not go through tcg2_measurement_init() or the EFI TCG2 protocol. Note that with CONFIG_TPM_PCR_ALLOCATE enabled, this lets tpm2_startup() fail if the unsupported banks cannot be deactivated. The rationale is that enabling the option asks U-Boot to manage the banks, so failing early seems preferable to failing at the first PCR extend. Tested on a downstream U-Boot based on v2025.04 with a TPM implementing six PCR banks, with the unsupported banks both inactive and active. Build- and unit-tested (ut dm tpm, ut lib) on sandbox against main. Changes in v2: - 5/5: deactivate the unsupported banks in tpm2_startup() instead of tpm2_auto_start(), and only if TPM2_Startup(TPM2_SU_CLEAR) succeeded, i.e. not if an earlier boot stage already started the TPM, and not for TPM2_SU_STATE (Ilias) - rebased onto current main Changes in v3: - Add Reviewed-by tags from Ilias to patches 1-4 v1: https://lore.kernel.org/u-boot/[email protected]/ v2: https://lore.kernel.org/u-boot/[email protected]/ Tycho Kirchner (5): tpm: check allocationSuccess of TPM2_PCR_Allocate tpm: allow TPMs with more banks than U-Boot knows algorithms for tpm: detect active banks with algorithms unknown to U-Boot tpm: deactivate only unsupported banks before PCR extend tpm: deactivate unsupported banks in tpm2_startup() lib/tpm-v2.c | 76 ++++++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 65 insertions(+), 11 deletions(-) -- 2.47.3
