u-boot.git/lib/tpm_tcg2.c, branch master

tpm2: add sm3 256 hash support

2025-12-04T15:38:58+00:00

add sm3 256 hash support, so TPM2 chips which report
5 pcrs with sm3 hash do not fail with:

  u-boot=> tpm2 autostart
  tpm2_get_pcr_info: too many pcrs: 5
  Error: -90

Signed-off-by: Heiko Schocher

tpm: get tpm event log from bloblist

2025-01-28T07:09:32+00:00

Get tpm event log from bloblist instead of FDT when bloblist is
enabled and valid from previous boot stage.

Signed-off-by: Raymond Mao 
Reviewed-by: Ilias Apalodimas 
Signed-off-by: Ilias Apalodimas

tpm: add PCR allocate into the eventlog handling

2025-01-28T06:58:41+00:00

Get eventlog bank mask when parsing the eventlog from previous
boot stage and invoke PCR allocate function based on it.
PCR allocate will be proceeded if any dismatches observed among
the active, supportted and eventlog bank masks to re-configurate
the TPM with the proper algorithms and reboot the system.

Signed-off-by: Raymond Mao 
Reviewed-by: Ilias Apalodimas 
Signed-off-by: Ilias Apalodimas

tpm: add kconfig control in tcg2_create_digest()

2025-01-07T13:45:52+00:00

To allow disabling algorithms for tcg2, in function
tcg2_create_digest(), each hash algorithm operations should under
the hash kconfig control to avoid building errors when the algorithm
is disabled.

Signed-off-by: Raymond Mao 
Reviewed-by: Ilias Apalodimas

tpm: Don't replay an EventLog if tcg2_log_parse() fails

2025-01-07T13:45:52+00:00

We used to stop replaying an EventLog if parsing failed, but that got
lost in commit 97707f12fdab ("tpm: Support boot measurements").

When an EventLog is passed yo us from a previous bootloader, we want to
validate it as much as we can and make sure the defined PCR banks of
the log exist in our TPM and firmware so we can replay it if needed or
use it as-in, in case the PCRs are already extended.

So let's add the checks back and while at it simplify the logic of
rejecting an EventLog.

Signed-off-by: Raymond Mao 
Signed-off-by: Ilias Apalodimas

tpm: Simplify tcg2_log_init()

2025-01-07T13:45:52+00:00

A previous patch is storing the active PCR banks on the TPM private
data. Instead of parsing them on the fly use the stored values.
This allows us to simplify our checks during the log creation and
parsing.

Signed-off-by: Raymond Mao 
Signed-off-by: Ilias Apalodimas

tpm: Simplify tcg2_create_digest()

2025-01-07T13:45:51+00:00

A previous patch is storing the active PCR banks on the TPM private
data. Instead of parsing them on the fly use the stored values.
This allows us to simplify our checks during the log creation and
parsing.

Signed-off-by: Raymond Mao 
Signed-off-by: Ilias Apalodimas

tpm: Don't create an EventLog if algorithms are misconfigured

2025-01-07T13:45:51+00:00

We already check the active banks vs what U-Boot was compiled with when
trying to extend a PCR and we refuse to do so if the TPM active ones
don't match the ones U-Boot supports.

Do the same thing for the EventLog creation since extending will fail
anyway and print a message so the user can figure out the missing
algorithms.

Co-developed-by: Raymond Mao 
Signed-off-by: Raymond Mao 
Signed-off-by: Ilias Apalodimas

tpm: add flag in hash_algo_list and API to check if algorithm is supported

2025-01-07T13:45:51+00:00

Add a bool var into hash_algo_list to indicate whether the algorithm
is supported or not and move the IS_ENABLED to only cover this var.
So that we can have the name, hash, mask and size no matter the
digest kconfigs are enabled or not.

In before, tpm2_algorithm_to_len() and tcg2_algorithm_to_mask() are used to
identify an unsupported algorithm when they return 0.
It is not the case now when hash_algo_list always provides algorithm size
and mask, thus a new API is introduced to check if an algorithm is
supported by U-Boot.

Suggested-by: Ilias Apalodimas 
Signed-off-by: Raymond Mao 
Reviewed-by: Ilias Apalodimas 
Signed-off-by: Ilias Apalodimas

tpm: refactor tcg2_get_pcr_info()

2025-01-07T13:45:51+00:00

Rename the arguments of tcg2_get_pcr_info() to clarify
they are bank masks, not PCR mask.
Remove the unused local variable.

Signed-off-by: Raymond Mao 
Reviewed-by: Ilias Apalodimas