Re: Tianocore and TPM2 pcr values

[Jorge Fernandez Monteagudo <jorgefm@cirsa.com>]

Hi Chao!


Maybe the traces I get from the debug build and


  gEfiMdePkgTokenSpaceGuid.PcdReportStatusCodePropertyMask|0x7
  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x800A044F
  gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x2F

can help.


________________________________
De: edk2-devel <edk2-devel-bounces@lists.01.org> en nombre de Jorge Fernandez Monteagudo <jorgefm@cirsa.com>
Enviado: martes, 25 de septiembre de 2018 16:09:31
Para: Zhang, Chao B; edk2-devel@lists.01.org
Asunto: Re: [edk2] Tianocore and TPM2 pcr values

Hi Chao!


PCR0 has not changed in any of the test I've done! What info do you need?


I'm using:

coreboot: ae05d095b36ac835a6b1a221e6858065e5486888, master branch

tianocore: 07ecd98ac18d6792181856faca7d4bed1b587261, coreboot branch

Attached are the changes I've done to tianocore to get TPM2 support and no console.
PCR0 is always 3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969

Thanks!
________________________________
De: Zhang, Chao B <chao.b.zhang@intel.com>
Enviado: martes, 25 de septiembre de 2018 15:41:45
Para: Jorge Fernandez Monteagudo; edk2-devel@lists.01.org
Cc: You, Benjamin
Asunto: RE: Tianocore and TPM2 pcr values

Hi Jorge:
    PCR 0 should change if you  use different core boot payload + UEFI. So your case seems to be an issue. Can you provide more detailed info?


-----Original Message-----
From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Jorge Fernandez Monteagudo
Sent: Monday, September 24, 2018 5:57 PM
To: edk2-devel@lists.01.org
Subject: [edk2] Tianocore and TPM2 pcr values

Hi all,


This is my first message in this list. I'm using tianocore as a payload for a Coreboot in order to

boot a custom board I'm working on it. Finally I've been able to enable the TPM2 support in

coreboot and in tianocore but I have some questions regarding the values I'm seeing in the PCRs.


I'm using Tianocore master branch as is selected by coreboot menuconfig and x64 architecture.

Once the system is running I can read the PCRs and, if I'm not wrong, PCRs 0 to 7 are handled

by the Tianocore/Coreboot. I've flashed a coreboot+tianocore in release mode and a coreboot+

tianocore in debug mode and the PCRs are the same. Is it ok? I thought that any change in the

coreboot.rom will made the PCR values to change...


pcr0: 3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
pcr1: a3a3552caa68c6d9db64bf1ed4dca08080f99b59f1b26debc9abefa59ee8ca28
pcr2: 3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
pcr3: 3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
pcr4: 74a35102770e65ab94b35135a4bf54c411134ae8059e03df41060a33f573871f
pcr5: dfa65561584cb8604b1675c869f3341d0c99c642ce9d91353380361126235ad8
pcr6: 3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
pcr7: b5710bf57d25623e4019027da116821fa99f5c81e9e38b87671cc574f9281439

Another test I've done is using the Tianocore stable branch as selected by coreboot
(STABLE_COMMIT_ID=315d9d08fd77db1024ccc5307823da8aaed85e2f) and I get the same values from release and build coreboot.roms except that PCR1 has the same value as PCR0, 2, 3 and 6, it seems it's not used in this version.

Is this the expected behavior?

Thanks!
Jorge
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel