On Tue, 3 Nov 2026 at 10:44, Tycho Kirchner <[email protected]> wrote: > > Hi Ilias, > > Am 02.11.26 um 22:00 schrieb Ilias Apalodimas: > > On Mon, 2 Nov 2026 at 12:35, Tycho Kirchner <[email protected]> wrote: > >> I would rather keep it as a fallback: callers may use tpm2_startup() > >> directly instead of tpm_auto_start(), e.g. custom board code or > >> "tpm2 startup" followed by "tpm2 pcr_extend" on the command line. For > >> them, the check in tpm2_pcr_extend() is the only place where active > >> unsupported banks are caught. With patch 4, it only deactivates the > >> unsupported banks, and only with CONFIG_TPM_PCR_ALLOCATE. > > > > Yes that's what I was implying, but I wasn't very clear. Is there a > > reason we can't move it to tpm2_startup()? tpm_auto_start() is calling > > it anyway unless it's already initialized. > > No, that works. For v2, I would deactivate the unsupported banks in > tpm2_startup() with CONFIG_TPM_PCR_ALLOCATE, but only if the TPM was > actually started there, i.e. TPM2_Startup(TPM2_SU_CLEAR) returned > success. If it returns TPM2_RC_INITIALIZE, an earlier stage (e.g. SPL > or TF-A) has already started the TPM and is expected to have taken > care of the banks. With an event log, tcg2_log_prepare_buffer() still > aligns them afterwards. TPM2_SU_STATE, i.e. tpm_resume(), is left > alone. > > The fallback in tpm2_pcr_extend() from 4/5 stays, for the case that > the earlier stage supports more algorithms than U-Boot. > > I suggest something like: > > ``` > ret = tpm_sendrecv_command(dev, command_v2, NULL, NULL); > if ((ret && ret != TPM2_RC_INITIALIZE) || !bon) > return ret; > > /* > * Only the stage which actually starts the TPM deactivates the > * unsupported banks. On success, this resets the board. > */ > if (IS_ENABLED(CONFIG_TPM_PCR_ALLOCATE) && !ret && > mode == TPM2_SU_CLEAR) { > ret = tpm2_activate_banks(dev, 0); > if (ret) { > log_err("TPM: failed to deactivate unsupported banks\n"); > return ret; > } > } > > return tpm2_update_active_banks(dev); > ``` > > What do you think?
Yes, that's what I had in mind! Thanks /Ilias > > > Thanks, > Tycho > > > > > >> > >> > >> > >>>> > >>>> tcg2_create_digest: unsupported algorithm 28 > >>>> Cannot extend PCRs if all the TPM enabled algorithms are not supported > >>>> > >>>> Deactivate them in tpm2_auto_start() already, before anything gets > >>>> measured. If this fails, e.g. because the TPM refuses the allocation or > >>>> no supported bank would remain active, return an error. The rationale > >>>> is that with CONFIG_TPM_PCR_ALLOCATE enabled, U-Boot is expected to > >>>> manage the banks, so fail early instead of at the first PCR extend. > >>>> This is in line with the TPM_PCR_ALLOCATE help text, which does not > >>>> specify at which point during boot the allocation takes place. > >>>> > >>>> Signed-off-by: Tycho Kirchner <[email protected]> > >>>> --- > >>>> lib/tpm-v2.c | 12 ++++++++++++ > >>>> 1 file changed, 12 insertions(+) > >>>> > >>>> diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c > >>>> index 18ec9eb960d..bd049fed748 100644 > >>>> --- a/lib/tpm-v2.c > >>>> +++ b/lib/tpm-v2.c > >>>> @@ -232,6 +232,18 @@ u32 tpm2_auto_start(struct udevice *dev) > >>>> if (rc) > >>>> return rc; > >>>> > >>>> + /* > >>>> + * Early deactivate active banks with unsupported algorithms. On > >>>> success, > >>>> + * this resets the board. > >>>> + */ > >>>> + if (IS_ENABLED(CONFIG_TPM_PCR_ALLOCATE)) { > >>>> + rc = tpm2_activate_banks(dev, 0); > >>>> + if (rc) { > >>>> + log_err("TPM: failed to deactivate unsupported > >>>> banks\n"); > >>>> + return rc; > >>>> + } > >>>> + } > >>>> + > >>>> return tpm2_update_active_banks(dev); > >>>> } > >>>> > >>>> -- > >>>> 2.47.3 > >>>> > >> > >> -- > >> M.Sc. Tycho Kirchner > >> > >> emlix GmbH > >> Headquarters: Berliner Str. 12, 37073 Göttingen, Germany > >> Phone +49 (0)551 30664-0, e-mail [email protected] > >> District Court of Göttingen, Registry Number HR B 3160 > >> Managing Directors: Heike Jordan, Dr. Uwe Kracke > >> VAT ID No. DE 205 198 055 > >> Office Berlin: Panoramastr. 1, 10178 Berlin, Germany > >> Office Bonn: Bachstr. 6, 53115 Bonn, Germany > >> Office München: Am Knie 16, 81241 München, Germany > >> http://www.emlix.com > >> > >> emlix - your embedded Linux partner > >> >
