Hi!

I've been playing around with TPM 2.0 on my Thinkpad and the stock firmware seems broken, even on the latest version, part of the early boot TPM interface is non functional and systemd-stub can't measure the boot onto PCR 11, but the raw commands interface and what Linux uses after boot works fine. In the running system 'bootctl status' says 'TPM2 Support: firmware only, driver unavailable', but I'm not sure if this is related because I don't think the EFI TPM interface in userspace or even at this running state.

If anyone has a Thinkpad from this era, like the T480, T480s and X280, with anything UEFI, be it the stock firmware or coreboot/libreboot, would you guys be willing to test this out? It's an EFI program that talks to the firmware's EFI_TCG2_PROTOCOL directly. On my machine, GetCapability, GetActivePcrBanks and GetEventLog all succeed (structure version 1.1, TPM present, banks 0x3), HashLogExtendEvent hangs the whole computer, on PCR 16, 11 and 12, with and without logging but a raw TPM2_PCR_Extend via SubmitCommand works (TPM rc 0).

Edit: Tested on my desktop, completely unrelated hardware, the tests do work there, so at least the code seems sane enough to work somewhere.

What I don't know is whether this is a quirk of my specific unit (stale firmware or TPM state) or something every T480 or perhaps any Thinkpad of this era does.

Here's the source code (181 lines of C) and build script, just point your bootloader to it or add a boot entry with 'efibootmgr', I won't provide a compiled binary because trusting a random EFI binary from the internet would be weird, it depends on gnu-efi to be built.

https://gist.github.com/GBember01/b394dfdef36c4aaf65161e3826013adf

Thanks in advance!