tree 80d74b02f7ce5e31c718cb402ae36eca72613f38
parent e445bba72834749200c6073096e66829dddfe624
author Eric Richter <erichte@linux.ibm.com> 1636045384 -0500
committer Cédric Le Goater <clg@kaod.org> 1636045639 +0100

secvar/secboot_tpm: correctly reset the control index on secboot format

When the SECBOOT partition is formatted, the bank hash stored in the
control TPM NV index must be updated to match, or else we will immediately
fail to load the freshly formatted data at the .load_bank() step.

However, while the secboot_format() function does calculate and update the
bank hash, it only writes the new hash for bank 0. It does not update the
value for bank 1, or set the current active bank. This works as expected if
the active bank bit happens to be set to 0. On the other hand, if the active
bit is set to 1, the freshly formatted bank 1 will be compared against the
unchanged bank hash in bank 1 at the load step, therefore causing an error.

This patch fixes this issue by also setting the active bit to 0 to match
the freshly calculated hash.

Signed-off-by: Eric Richter <erichte@linux.ibm.com>
Tested-by: Nick Child <nick.child@ibm.com>
Reviewed-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Cédric Le Goater <clg@kaod.org>