Commit e7e166dabf12 ("tpm: PCR allocate during PCR extend to disable
the unsupported algorithms") intends to deactivate active banks with
unsupported algorithms when extending a PCR. However, it calls
tpm2_pcr_allocate() with an algorithm mask of 0, which deactivates
*all* banks, including the supported ones:
set bank[0] sha1 off
set bank[1] sha256 off
...
If the TPM refuses this allocation, nothing changes, and the same
happens again on every boot. If the TPM accepts it, no bank is active
after the next TPM2_Startup, so nothing can be measured on any later
boot either. Moreover, the allocation is changed regardless of
CONFIG_TPM_PCR_ALLOCATE.
Instead, if CONFIG_TPM_PCR_ALLOCATE is enabled, call
tpm2_activate_banks(), which keeps the supported active banks,
deactivates the others and resets the board. Otherwise, leave the
allocation untouched. In both cases, the extend fails while unsupported
banks are active.
Fixes: e7e166dabf12 ("tpm: PCR allocate during PCR extend to disable the
unsupported algorithms")
Signed-off-by: Tycho Kirchner <[email protected]>
Reviewed-by: Ilias Apalodimas <[email protected]>
---
lib/tpm-v2.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c
index b727c645d73..18ec9eb960d 100644
--- a/lib/tpm-v2.c
+++ b/lib/tpm-v2.c
@@ -362,9 +362,15 @@ u32 tpm2_pcr_extend(struct udevice *dev, u32 index, u32
algorithm,
if (!tpm2_check_active_banks(dev)) {
log_err("Cannot extend PCRs if all the TPM enabled algorithms
are not supported\n");
- ret = tpm2_pcr_allocate(dev, 0);
- if (ret)
- return -EINVAL;
+ /*
+ * Deactivate the unsupported banks. On success this resets
+ * the board, since the new allocation only takes effect after
+ * the next TPM2_Startup.
+ */
+ if (IS_ENABLED(CONFIG_TPM_PCR_ALLOCATE))
+ tpm2_activate_banks(dev, 0);
+
+ return -EINVAL;
}
/*
* Fill the command structure starting from the first buffer:
--
2.47.3
