Conversation
PCR 16 was historically scratch space for calcfuturepcr on TPM1 (PCR 23 on TPM2). calcfuturepcr was later rewritten to replay from cbmem -L event log, eliminating the need for any scratch PCR. PCR 16 is now unused. Extends doc/tpm.md fix (linuxboot/heads#2203). Signed-off-by: Thierry Laurion <insurgo@riseup.net>
Collaborator
Author
|
Closing — will reopen from fork. |
There was a problem hiding this comment.
🟢 Approval recommended
The change is documentation-only and low risk, with only a minor formatting consistency nit noted.
Pull request overview
Updates the Heads wiki TPM PCR documentation to correct the historical/current status of PCR 16, aligning the wiki text with the known evolution of calcfuturepcr behavior described in the PR.
Changes:
- Replaces the outdated PCR 16 description with a more accurate historical explanation and notes that PCR 16 is now unused.
- Clarifies that later implementations replay from the
cbmem -Levent log rather than using a scratch PCR.
File summaries
| File | Description |
|---|---|
| About/Keys.md | Updates PCR 16 documentation to reflect historical usage and current non-use. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
|
||
| (16): Used for TPM futurecalc of LUKS header when setting up a TPM disk | ||
| encryption key | ||
| (16): Not measured or read by Heads. Historically used as scratch PCR by |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Extends doc/tpm.md fix (linuxboot/heads#2203) to the wiki.
Changes
PCR 16 description updated from "Used for TPM futurecalc of LUKS header" to accurate history:
calcfuturepcron TPM1 (TPM2 used PCR 23)calcfuturepcrwas later rewritten to replay fromcbmem -Levent log, eliminating the need for any scratch PCREvidence
68cc9d0b132(2017): originaltpm calcfuturepcr -ix 16call inkexec-seal-key.sh80c4a7ea6ea: TPM1 branch used PCR 16, TPM2 used PCR 23d1a18f1f83b:tpmr.shintroduced,calcfuturepcrrewritten toreplay_pcrusingcbmem -Ltpmr.sh:208-230:replay_pcrrejectspcr >= 8, no physical PCR touchedRelated