Re: TPM selftest failure in 4.15

Ken Goldman
2018-04-08T18:27:06Z

On 2/9/2018 11:23 AM, James Bottomley wrote:
> On Fri, 2018-02-09 at 07:26 -0500, Mimi Zohar wrote:
>> On Fri, 2018-02-09 at 12:02 +0200, Jarkko Sakkinen wrote:

> It seems that the PCRs are one of the earliest things to come
> on-line, so IMA always works. This is on my current laptop where I'm
> running this patch with IMA: I no longer see the IMA bypass message and
> IMA comes up normally.
>

I would expect PCRs to be available by the time IMA needs them because
the firmware also extends to PCRs. Therefore, the hash algorithms will
be tested very early in boot.

I only worry about the resume from suspend case, where firmware won't be
doing extends.