Skip to content

Commit d1ba827

Browse files
committed
pcr-measurements.md: Add a note on non-critical for the firmware PCR8-15 fails
Signed-off-by: Filip Gołaś <filip.golas@3mdeb.com>
1 parent 4a49679 commit d1ba827

File tree

2 files changed

+15
-0
lines changed

2 files changed

+15
-0
lines changed

docs/kb/images/pcr_usage.png

180 KB
Loading

docs/kb/pcr-measurements.md

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -150,8 +150,23 @@ and data they use and also show up in the event log. You can find more details
150150
in the documentation of respective tools (e.g., for [GRUB2][grub] or
151151
[shim][shim]).
152152

153+
Due to this fact the failing to reconstruct some of the PCRs does not
154+
mean a firmware issue.
155+
156+
The table below shows the PCR Usage according to
157+
[TCG PC Client Platform Firmware Profile Specification][tcg-pcclient-pfps].
158+
The firmware mainly uses the PCRs in range 0-7, and the range 8-15 is reserved
159+
for the OS:
160+
![PCR usage table](images/pcr_usage.png)
161+
162+
It's worth keeping that in mind when analysing the reconstructed PCRs,
163+
as especially the PCR 10 used by Linux Integrity Management Architecture
164+
[had a history of failing to be reconstructed from the TPM logs](https://github.com/Dasharo/dasharo-issues/issues/1709#issuecomment-3791854544)
165+
.
166+
153167
[grub]: https://www.gnu.org/software/grub/manual/grub/html_node/Measured-Boot.html
154168
[shim]: https://github.com/rhboot/shim/blob/master/README.tpm
169+
[tcg-pcclient-pfps]: https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_PFP_r1p05_v23_pub.pdf
155170

156171
## Caveats
157172

0 commit comments

Comments
 (0)