> The only way to add data to a PCR is with TPM Extend Current value of
> a PCR is X. (Say, 0x0000....0000.) We extend the PCR with some data Y.
> Y must be 160 bit (20 byte) value 20 bytes = SHA1 hash, allowing
> longer data TPM calculates hash(Y,X)=Z; changes value in PCR to Z. We
> can update further: Extend with A: value is hash(A,Z)=hash(A,
> hash(Y,X)) Extend with B: PCR value is hash(B, hash(A,Z)) ...etc.
> Verifiers who know the values extended into the PCRs can easily verify
> Perform the same hash chain themselves Computationally infeasible to
> forge (must break SHA-1) Given PCR state N and desired state M,
> adversary would need to find X such that hash(X,N)=M; violates one-way
> assumption
> 
> 
> Some (but not all) PCRs are resettable. This means they can be reset
> to a known state by executing the TPM PCR Reset command. Whether a
> given PCR is resettable or not is defined in platform spec All PC
> client TPMs have the same settings Server or virtual TPMs could
> differ; specs do not exist yet Reset requires appropriate permissions
> Usually based on locality, which we’ll discuss next Sets PCR value
> back to default, erasing all data currently present Either 0x000...000
> or 0xFFF...FFF, depending on PCR & machine state

[SOURCE][1]


  [1]: http://opensecuritytraining.info/IntroToTrustedComputing_files/Day2-1-auth-and-att.pdf