u-boot.git/include/tpm-v2.h, branch master

tpm2: add sm3 256 hash support

2025-12-04T15:38:58+00:00

add sm3 256 hash support, so TPM2 chips which report
5 pcrs with sm3 hash do not fail with:

  u-boot=> tpm2 autostart
  tpm2_get_pcr_info: too many pcrs: 5
  Error: -90

Signed-off-by: Heiko Schocher

cmd: tpm: Fix attempt to return value not in enum

2025-07-01T05:46:38+00:00

The function tpm2_name_to_algorithm is defined as returning an
enum for the algorithm specified but it also attempts to return
an error on failure, but that error is not included in the enum.
Add the error to the enum so that it can be returned.

This issue was reported by Smatch.

Signed-off-by: Andrew Goodbody 
Reviewed-by: Ilias Apalodimas 
Signed-off-by: Ilias Apalodimas

tpm: add wrapper and helper APIs for PCR allocate

2025-01-28T06:58:41+00:00

Add PCR allocate wrapper APIs for using in tcg2 protocol.
The wrapper proceeds a PCR allocate command, followed by a
shutdown command.
A system boot is required after two commands since TPM device needs
a HW reset to activate the new algorithms config.
Also, a helper function is included to determine the new bank mask
for PCR allocation by combining the status of current active,
supported and eventlog bank masks.
A new kconfig is created. PCR allocate and system reboot only
happens when the kconfig is selected, otherwise just exit with
errors.

Signed-off-by: Raymond Mao 
Reviewed-by: Ilias Apalodimas 
Signed-off-by: Ilias Apalodimas

tpm: add TPM2_PCR_Allocate command

2025-01-28T06:58:41+00:00

TPM2_PCR_Allocate command is required to reconfigure a TPM device
to enable or disable algorithms in run-time, thus this patch introduces
the implementation of PCR allocate APIs and adds related cmd functions
for testing.

To test the feature, ensure that TPM is started up.
Run pcr_allocate command to turn on/off an algorithm, multiple calls
are supported and all changes will be cached:
`tpm2 pcr_allocate  `
Run startup command with argument 'off' to shutdown the TPM.
`tpm2 startup TPM2_SU_CLEAR off`
Reboot the board via `reset` to activate the changes.

Signed-off-by: Raymond Mao 
Acked-by: Ilias Apalodimas 
Signed-off-by: Ilias Apalodimas

tpm: add TPM2_Shutdown command

2025-01-28T06:58:41+00:00

TPM2_shutdown command is sharing same structure and logics with
TPM2_startup, thus this patch extends the existing startup APIs and
cmd functions to support shutdown instead of created new ones.

Signed-off-by: Raymond Mao 
Reviewed-by: Ilias Apalodimas 
Signed-off-by: Ilias Apalodimas

tpm: update descriptions in tpm headers

2025-01-09T17:11:10+00:00

* Provide a link to 'TPM 2.0 Library Specification'
* Remove outdated comment for TPM2_NUM_PCR_BANKS.
  The value 16 can be found in the current standard
  TCG TSS 2.0 Overview and Common Structures Specification 1.0, rev 10
* Describe some of the structures in Sphinx style.

Signed-off-by: Heinrich Schuchardt 
Reviewed-by: Ilias Apalodimas 
Reviewed-by: Miquel Raynal 
Signed-off-by: Ilias Apalodimas

tpm: Keep the active PCRs in the chip private data

2025-01-07T13:45:51+00:00

We have a lot of code trying to reason about the active TPM PCRs
when creating an EventLog. Since changing the active banks can't
be done on the fly and requires a TPM reset,  let's store them
in the chip private data instead.

Upcoming patches will use this during the EventLog creation.

Signed-off-by: Raymond Mao 
Signed-off-by: Ilias Apalodimas

tpm: Don't create an EventLog if algorithms are misconfigured

2025-01-07T13:45:51+00:00

We already check the active banks vs what U-Boot was compiled with when
trying to extend a PCR and we refuse to do so if the TPM active ones
don't match the ones U-Boot supports.

Do the same thing for the EventLog creation since extending will fail
anyway and print a message so the user can figure out the missing
algorithms.

Co-developed-by: Raymond Mao 
Signed-off-by: Raymond Mao 
Signed-off-by: Ilias Apalodimas

tpm: add flag in hash_algo_list and API to check if algorithm is supported

2025-01-07T13:45:51+00:00

Add a bool var into hash_algo_list to indicate whether the algorithm
is supported or not and move the IS_ENABLED to only cover this var.
So that we can have the name, hash, mask and size no matter the
digest kconfigs are enabled or not.

In before, tpm2_algorithm_to_len() and tcg2_algorithm_to_mask() are used to
identify an unsupported algorithm when they return 0.
It is not the case now when hash_algo_list always provides algorithm size
and mask, thus a new API is introduced to check if an algorithm is
supported by U-Boot.

Suggested-by: Ilias Apalodimas 
Signed-off-by: Raymond Mao 
Reviewed-by: Ilias Apalodimas 
Signed-off-by: Ilias Apalodimas

tpm: Rename tpm2_allow_extend()

2025-01-07T13:45:51+00:00

When that function was introduced we were only using it to check if
extending a PCR was allowed, so the name made sense. A few patches ago
we used that function to reason about the EventLog creation and general
usage of PCRs , so let's rename it to something more generic that makes
more sense in all contexts.

Signed-off-by: Raymond Mao 
Signed-off-by: Ilias Apalodimas