u-boot.git/lib/tpm-v2.c, branch next

tpm2: add sm3 256 hash support

2025-12-04T15:38:58+00:00

add sm3 256 hash support, so TPM2 chips which report
5 pcrs with sm3 hash do not fail with:

  u-boot=> tpm2 autostart
  tpm2_get_pcr_info: too many pcrs: 5
  Error: -90

Signed-off-by: Heiko Schocher

tpm: Make use of TPM2_ALG_INVAL from enum

2025-07-01T05:46:38+00:00

Now that the enum includes TPM2_ALG_INVAL, use that name in the
code.

Reviewed-by: Ilias Apalodimas 
Signed-off-by: Andrew Goodbody 
Signed-off-by: Ilias Apalodimas

tpm: PCR allocate during PCR extend to disable the unsupported algorithms

2025-01-28T06:58:41+00:00

During PCR extend process, if any unsupported algorithms are active,
try to use PCR allocate to inactivate them.

Signed-off-by: Raymond Mao 
Acked-by: Ilias Apalodimas 
Reviewed-by: Ilias Apalodimas 
Signed-off-by: Ilias Apalodimas

tpm: add wrapper and helper APIs for PCR allocate

2025-01-28T06:58:41+00:00

Add PCR allocate wrapper APIs for using in tcg2 protocol.
The wrapper proceeds a PCR allocate command, followed by a
shutdown command.
A system boot is required after two commands since TPM device needs
a HW reset to activate the new algorithms config.
Also, a helper function is included to determine the new bank mask
for PCR allocation by combining the status of current active,
supported and eventlog bank masks.
A new kconfig is created. PCR allocate and system reboot only
happens when the kconfig is selected, otherwise just exit with
errors.

Signed-off-by: Raymond Mao 
Reviewed-by: Ilias Apalodimas 
Signed-off-by: Ilias Apalodimas

tpm: add TPM2_PCR_Allocate command

2025-01-28T06:58:41+00:00

TPM2_PCR_Allocate command is required to reconfigure a TPM device
to enable or disable algorithms in run-time, thus this patch introduces
the implementation of PCR allocate APIs and adds related cmd functions
for testing.

To test the feature, ensure that TPM is started up.
Run pcr_allocate command to turn on/off an algorithm, multiple calls
are supported and all changes will be cached:
`tpm2 pcr_allocate  `
Run startup command with argument 'off' to shutdown the TPM.
`tpm2 startup TPM2_SU_CLEAR off`
Reboot the board via `reset` to activate the changes.

Signed-off-by: Raymond Mao 
Acked-by: Ilias Apalodimas 
Signed-off-by: Ilias Apalodimas

tpm: add TPM2_Shutdown command

2025-01-28T06:58:41+00:00

TPM2_shutdown command is sharing same structure and logics with
TPM2_startup, thus this patch extends the existing startup APIs and
cmd functions to support shutdown instead of created new ones.

Signed-off-by: Raymond Mao 
Reviewed-by: Ilias Apalodimas 
Signed-off-by: Ilias Apalodimas

tpm: Keep the active PCRs in the chip private data

2025-01-07T13:45:51+00:00

We have a lot of code trying to reason about the active TPM PCRs
when creating an EventLog. Since changing the active banks can't
be done on the fly and requires a TPM reset,  let's store them
in the chip private data instead.

Upcoming patches will use this during the EventLog creation.

Signed-off-by: Raymond Mao 
Signed-off-by: Ilias Apalodimas

tpm: Don't create an EventLog if algorithms are misconfigured

2025-01-07T13:45:51+00:00

We already check the active banks vs what U-Boot was compiled with when
trying to extend a PCR and we refuse to do so if the TPM active ones
don't match the ones U-Boot supports.

Do the same thing for the EventLog creation since extending will fail
anyway and print a message so the user can figure out the missing
algorithms.

Co-developed-by: Raymond Mao 
Signed-off-by: Raymond Mao 
Signed-off-by: Ilias Apalodimas

tpm: add flag in hash_algo_list and API to check if algorithm is supported

2025-01-07T13:45:51+00:00

Add a bool var into hash_algo_list to indicate whether the algorithm
is supported or not and move the IS_ENABLED to only cover this var.
So that we can have the name, hash, mask and size no matter the
digest kconfigs are enabled or not.

In before, tpm2_algorithm_to_len() and tcg2_algorithm_to_mask() are used to
identify an unsupported algorithm when they return 0.
It is not the case now when hash_algo_list always provides algorithm size
and mask, thus a new API is introduced to check if an algorithm is
supported by U-Boot.

Suggested-by: Ilias Apalodimas 
Signed-off-by: Raymond Mao 
Reviewed-by: Ilias Apalodimas 
Signed-off-by: Ilias Apalodimas

tpm: Rename tpm2_allow_extend()

2025-01-07T13:45:51+00:00

When that function was introduced we were only using it to check if
extending a PCR was allowed, so the name made sense. A few patches ago
we used that function to reason about the EventLog creation and general
usage of PCRs , so let's rename it to something more generic that makes
more sense in all contexts.

Signed-off-by: Raymond Mao 
Signed-off-by: Ilias Apalodimas