Hi Tycho, On Thu, 29 Oct 2026 at 17:09, Tycho Kirchner <[email protected]> wrote: > > With CONFIG_TPM_PCR_ALLOCATE, active banks with unsupported algorithms > are only deactivated by tcg2_log_prepare_buffer() or, as a fallback, > when a PCR is extended. Users of the TPM which do not go through > tcg2_measurement_init() therefore only notice the unsupported banks > when measuring, e.g.
Yes, but users that will call measurement_init etc will have initialized the TPM. The PCR code exists because some users want to use the TPM only as an RNG. IIRC we can't get rid of the EFI call, because it's there to configure algos that where handed over to us from a previous stage loader that only handed us an EventLog. Can't we fet rid of it in pcr_extend though? Also if you do get rid of, this needs to go in tpm_init() instead of autostart Cheers /Ilias > > tcg2_create_digest: unsupported algorithm 28 > Cannot extend PCRs if all the TPM enabled algorithms are not supported > > Deactivate them in tpm2_auto_start() already, before anything gets > measured. If this fails, e.g. because the TPM refuses the allocation or > no supported bank would remain active, return an error. The rationale > is that with CONFIG_TPM_PCR_ALLOCATE enabled, U-Boot is expected to > manage the banks, so fail early instead of at the first PCR extend. > This is in line with the TPM_PCR_ALLOCATE help text, which does not > specify at which point during boot the allocation takes place. > > Signed-off-by: Tycho Kirchner <[email protected]> > --- > lib/tpm-v2.c | 12 ++++++++++++ > 1 file changed, 12 insertions(+) > > diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c > index 18ec9eb960d..bd049fed748 100644 > --- a/lib/tpm-v2.c > +++ b/lib/tpm-v2.c > @@ -232,6 +232,18 @@ u32 tpm2_auto_start(struct udevice *dev) > if (rc) > return rc; > > + /* > + * Early deactivate active banks with unsupported algorithms. On > success, > + * this resets the board. > + */ > + if (IS_ENABLED(CONFIG_TPM_PCR_ALLOCATE)) { > + rc = tpm2_activate_banks(dev, 0); > + if (rc) { > + log_err("TPM: failed to deactivate unsupported > banks\n"); > + return rc; > + } > + } > + > return tpm2_update_active_banks(dev); > } > > -- > 2.47.3 >
