[ehl] EHL BIOS cannot save changes to TPM settings

[Doug Jacobs]

Using EHL board (CID: 202105-29063)

Try to modify the TPM settings:
1. Boot into BIOS
2. Select Advanced Settings -> TPM configuration -> TPM2
3. Scroll down to PCR settings.
4. Unselect SHA256, select SM3_256
5. F4 to save.
6. Back out to main menu.
7. Choose Reset.

Expected result:
BIOS should warn user that the TPM settings have changed, and require you to hit F12 to accept the changes.

Actual result:
Board boots as normal and hangs due to default TPM settings (https://bugs.launchpad.net/intel/+bug/1939505)

Verification:
Reset board after failed boot attempt.
Boot into BIOS
Select Advanced Settings -> TPM -> TPM2
Scroll down to PCR settings.
SHA256 is selected. SM3_256 is not selected.

[Doug Jacobs (djacobs98)]

Reproduction steps part 2:
Repeat above steps, but instead of "Reset" choose "Continue."
(same results.)

[Doug Jacobs (djacobs98)]

Reproduction steps part 3:
Modify PCR settings for TPM (above steps.)
Hit F4
Hit ESC to back out one menu
Choose TPM2
Scroll down to PCR settings.

Expected result:
Your changes should be displayed.

Actual result:
Only SHA256 is selected. Your changes were not saved.

[Doug Jacobs (djacobs98)]

Reproduction steps part 4:
1. Boot into BIOS
2. Select: Advanced Settings -> TPM Configuration
3. Disable fTPM
4. F4 to save.
5. ESC to go up one menu.

Expected result:
fTPM is disabled.

Actual result:
fTPM is enabled. Your changes were not saved.

[Ivan Hu (ivan.hu)]

From the TCG PTP specification, section 4.6 PCR Requirements
https://trustedcomputinggroup.org/resource/pc-client-platform-tpm-profile-ptp-specification/

It tells,
"
3. A conformant TPM SHALL support SHA-384 (0x000C) and SHA-256 (0x000B). The TPM MAY support
additional Hash algorithms.
a. If the TPM supports only one bank of PCRs,
i. The default Hash Algorithm ID for the PCR SHALL be defined to be 0x000B (SHA-256).
"

I supposed that uncheck the sha256 and select another will return to sha256 may be an expected behavior, you should get confirm from the Bios vendor.

[Doug Jacobs (djacobs98)]

As per Intel's request, I unchecked sha256, and checked sm3_256. Yet the change did not take effect.

On the TGL-H board, I was able to make this change and have it stick. (It didn't help with https://bugs.launchpad.net/intel/+bug/1938678.)

Intel also wanted me to try different combinations of PCRs. I don't know if those were valid configurations or not, but once again, I was able to save the setting in the TGL-H board's BIOS (Select All, Select None) but not on the EHL board.

[Anthony Wong (anthonywong)]

Let check after we have flashed the new BIOS. Removing Ivan.

[Doug Jacobs (djacobs98)]

Board soon became completely inoperable due to corrupted BIOS and cannot be reflashed.

It also turns out this was a very old revision and CPU as well so not a valid platform for testing.