Skip to content

pcr-measurements.md: Add a note on non-critical PCR8-15 fails #1229

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BeataZdunczyk merged 1 commit into from
Feb 24, 2026
Merged

pcr-measurements.md: Add a note on non-critical PCR8-15 fails #1229

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file added docs/kb/images/pcr_usage.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
17 changes: 17 additions & 0 deletions docs/kb/pcr-measurements.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,8 +150,25 @@ and data they use and also show up in the event log. You can find more details
in the documentation of respective tools (e.g., for [GRUB2][grub] or
[shim][shim]).

Due to this fact the failing to reconstruct some of the PCRs does not
mean a firmware issue.

The table below shows the PCR Usage according to
[TCG PC Client Platform Firmware Profile Specification][tcg-pcclient-pfps].
The firmware mainly uses the PCRs in range 0-7, and the range 8-15 is reserved
for the OS:
![PCR usage table](images/pcr_usage.png)

It's worth keeping that in mind when analysing the reconstructed PCRs,
as especially the PCR 10 extended by
[Integrity Management Architecture](https://ima-doc.readthedocs.io/en/latest/index.html)
implementation in Linux
[had a history of failing to be reconstructed from the TPM logs][pcr_10_issue].

[grub]: https://www.gnu.org/software/grub/manual/grub/html_node/Measured-Boot.html
[shim]: https://github.com/rhboot/shim/blob/master/README.tpm
[tcg-pcclient-pfps]: https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_PFP_r1p05_v23_pub.pdf
[pcr_10_issue]: https://github.com/Dasharo/dasharo-issues/issues/1709#issuecomment-3791854544

## Caveats

Expand Down