A TPM implementing more PCR banks than U-Boot knows algorithms for is currently rejected by tpm2_get_pcr_info(), even if the unknown banks are inactive. Ours implements six banks, including SHA3-384:
tpm2_get_pcr_info: too many pcrs: 6 Once this limit is lifted (patch 2), the existing code for deactivating unsupported banks with CONFIG_TPM_PCR_ALLOCATE turns out not to work: - the result of TPM2_PCR_Allocate (allocationSuccess) is ignored, so a refused allocation goes unnoticed (patch 1) - active banks with algorithms not listed in hash_algo_list at all are never detected (patch 3) - the fallback in tpm2_pcr_extend() deactivates *all* banks and does not reset the board (patch 4) Patch 5 deactivates the unsupported banks in tpm2_auto_start() already, so that this happens before anything gets measured, also for users which do not go through tcg2_measurement_init(). Note that with CONFIG_TPM_PCR_ALLOCATE enabled, patch 5 makes tpm2_auto_start() fail if the unsupported banks cannot be deactivated. The rationale is that enabling the option asks U-Boot to manage the banks, so failing early seems preferable to failing at the first PCR extend. Tested on a downstream U-Boot based on v2025.04 with a TPM implementing six PCR banks, with the unsupported banks both inactive and active. Build- and unit-tested (ut dm tpm, ut lib) on sandbox against main. Tycho Kirchner (5): tpm: check allocationSuccess of TPM2_PCR_Allocate tpm: allow TPMs with more banks than U-Boot knows algorithms for tpm: detect active banks with algorithms unknown to U-Boot tpm: deactivate only unsupported banks before PCR extend tpm: deactivate unsupported banks in tpm2_auto_start() lib/tpm-v2.c | 75 ++++++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 64 insertions(+), 11 deletions(-) -- 2.47.3
