Re: Tianocore and TPM2 pcr values

["Zhang, Chao B" <chao.b.zhang@intel.com>]

Hi Jorge:
    PCR 0 should change if you  use different core boot payload + UEFI. So your case seems to be an issue. Can you provide more detailed info? 


-----Original Message-----
From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Jorge Fernandez Monteagudo
Sent: Monday, September 24, 2018 5:57 PM
To: edk2-devel@lists.01.org
Subject: [edk2] Tianocore and TPM2 pcr values

Hi all,


This is my first message in this list. I'm using tianocore as a payload for a Coreboot in order to

boot a custom board I'm working on it. Finally I've been able to enable the TPM2 support in

coreboot and in tianocore but I have some questions regarding the values I'm seeing in the PCRs.


I'm using Tianocore master branch as is selected by coreboot menuconfig and x64 architecture.

Once the system is running I can read the PCRs and, if I'm not wrong, PCRs 0 to 7 are handled

by the Tianocore/Coreboot. I've flashed a coreboot+tianocore in release mode and a coreboot+

tianocore in debug mode and the PCRs are the same. Is it ok? I thought that any change in the

coreboot.rom will made the PCR values to change...


pcr0: 3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
pcr1: a3a3552caa68c6d9db64bf1ed4dca08080f99b59f1b26debc9abefa59ee8ca28
pcr2: 3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
pcr3: 3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
pcr4: 74a35102770e65ab94b35135a4bf54c411134ae8059e03df41060a33f573871f
pcr5: dfa65561584cb8604b1675c869f3341d0c99c642ce9d91353380361126235ad8
pcr6: 3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
pcr7: b5710bf57d25623e4019027da116821fa99f5c81e9e38b87671cc574f9281439

Another test I've done is using the Tianocore stable branch as selected by coreboot
(STABLE_COMMIT_ID=315d9d08fd77db1024ccc5307823da8aaed85e2f) and I get the same values from release and build coreboot.roms except that PCR1 has the same value as PCR0, 2, 3 and 6, it seems it's not used in this version.

Is this the expected behavior?

Thanks!
Jorge
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel