Hi Ilias,
On Wed, 7 Jun 2023 at 10:18, Ilias Apalodimas
<ilias.apalodi...@linaro.org> wrote:
>
> Currently we only read the pcr updates once on test_tpm2_pcr_read().
> It turns out that the tpm init sequence of force_init() which consists
> of:
> - tpm2 init
> - tpm2 startup TPM2_SU_CLEAR
> - tpm2 self_test full
> - tpm2 clear TPM2_RH_LOCKOUT
>
> also counts as an update. Running this in the console verifies the
> update bump
> => tpm2 init
> => tpm2 startup TPM2_SU_CLEAR
> => tpm2 self_test full
> => tpm pcr_read 10 $loadaddr
> PCR #10 content (28 known updates):
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> => tpm2 clear TPM2_RH_LOCKOUT
> => tpm pcr_read 10 $loadaddr
> PCR #10 content (29 known updates):
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> =>
>
> With the recent changes of replacing 'tpm2 init' with 'tpm2 autostart'
> we end up always running the full init. The reason is 'tpm init'
> returns -EBUSY if the tpm is already open, while 'tpm autostart' handles
> ths gracefully and continues with the initialization. It's worth noting
> that this won't affect the device functionality at all since
> retriggering the startup sequence and selftests has no side effects.
This may be true for some TPMs.
>
> Instead of relying on the initial value, reread the 'known updates'
> just before updating the PCR to ensure we read the correct values
> before testing
>
> Signed-off-by: Ilias Apalodimas <ilias.apalodi...@linaro.org>
> ---
> Changes since v1:
> - new patch to fix the python testing failures
>
> test/py/tests/test_tpm2.py | 6 ++++++
> 1 file changed, 6 insertions(+)
>
Reviewed-by: Simon Glass <s...@chromium.org>
BTW this is an example of why I still want to be able to just init the
TPM to a basic level. Here we see that autostart changes the PCRs.
> diff --git a/test/py/tests/test_tpm2.py b/test/py/tests/test_tpm2.py
> index 1ade66a7eda4..fce689cd992d 100644
> --- a/test/py/tests/test_tpm2.py
> +++ b/test/py/tests/test_tpm2.py
> @@ -272,6 +272,12 @@ def test_tpm2_pcr_extend(u_boot_console):
> force_init(u_boot_console)
> ram = u_boot_utils.find_ram_base(u_boot_console)
>
> + read_pcr = u_boot_console.run_command('tpm2 pcr_read 0 0x%x' % (ram +
> 0x20))
> + output = u_boot_console.run_command('echo $?')
> + assert output.endswith('0')
> + str = re.findall(r'\d+ known updates', read_pcr)[0]
> + updates = int(re.findall(r'\d+', str)[0])
> +
> u_boot_console.run_command('tpm2 pcr_extend 0 0x%x' % ram)
> output = u_boot_console.run_command('echo $?')
> assert output.endswith('0')
> --
> 2.39.2
>
