How TPM PCRs Record UEFI Firmware Measurements

This article explains how Trusted Platform Module (TPM) Platform Configuration Registers (PCRs) record measurements of Unified Extensible Firmware Interface (UEFI) components during the boot process. It covers the cryptographic "extend" operation, the role of the Core Root of Trust for Measurement (CRTM), the specific PCR allocations defined by the Trusted Computing Group (TCG), and how the UEFI event log pairs with hardware registers to establish a verifiable chain of trust.

The Foundation: Cryptographic Hashing and the Extend Operation

A TPM does not allow software or firmware to arbitrarily write or overwrite values within a Platform Configuration Register (PCR). Overwriting would allow malicious code to clear evidence of its execution. Instead, the TPM updates PCR values strictly through a one-way mathematical process known as an Extend operation.

When a UEFI component is evaluated, the system computes a cryptographic hash (typically SHA-256) of that component's binary code or configuration data. This new hash is combined with the current value of the targeted PCR, and the combination is hashed again:

\[\text{PCR}_{\text{new}} = \text{Hash}(\text{PCR}_{\text{current}} \parallel \text{Hash}(\text{Component}))\]

Because hash functions are one-way and collision-resistant, the sequence of recorded measurements strictly dictates the final value. Even if the exact same components are loaded in a different order, the resulting PCR value will differ.

The Measurement Workflow in UEFI

The process of recording firmware states follows the principle of "measure before execution." The workflow proceeds in sequential stages:

  1. Core Root of Trust for Measurement (CRTM): The process begins with an inherently trusted, immutable block of code located in the platform hardware or SPI flash—typically the Pre-EFI Initialization (PEI) foundation or CPU microcode. The CRTM executes first and takes the very first measurement.
  2. Measurement via TCG Protocols: As the boot progresses into the Driver Execution Environment (DXE), the UEFI firmware exposes the EFI_TCG2_PROTOCOL. When a firmware module loads an executable image (such as a hardware driver or boot application), the DXE foundation invokes this protocol to calculate the image's hash before transferring execution control to it.
  3. Hardware Extension: The firmware passes the hash value to the TPM chip via a hardware bus (LPC, SPI, or an internal interface for firmware TPMs) alongside an instruction to extend a specific PCR index.
  4. TCG Event Logging: Concurrently, the UEFI firmware writes a descriptive entry into the TCG Event Log, which is maintained in system memory. The TPM chip itself holds only the cryptographic digest, not the names or details of what was measured. The Event Log contains the granular metadata (such as file paths, variable names, and raw digests) required to reconstruct and verify the sequence during an audit.

Standard UEFI PCR Allocations

The Trusted Computing Group specifies how individual PCRs (0 through 7) must be used by the platform firmware to measure specific components:

  • PCR 0 (Core System Firmware): Measures the CRTM, the UEFI BIOS code, power management firmware, and core platform hardware configurations.
  • PCR 1 (Host Platform Configuration): Measures non-volatile system settings, motherboard configurations, and system hardware inventory.
  • PCR 2 (Option ROM Code): Measures the executable code contained in add-in card Option ROMs (e.g., RAID controllers, discrete graphics cards).
  • PCR 3 (Option ROM Configuration): Measures the configuration settings and data associated with Option ROMs.
  • PCR 4 (Boot Manager Code): Measures the UEFI Boot Manager executable code, including pre-boot applications and the OS bootloader (e.g., Windows Boot Manager, GRUB).
  • PCR 5 (Boot Manager Data): Measures configuration parameters used by the boot manager, such as the GPT partition table and boot order variables.
  • PCR 6 (State Transitions): Measures resume events and power state transitions, such as waking from S3 sleep.
  • PCR 7 (Secure Boot Policy): Measures the state of UEFI Secure Boot, including the Platform Key (PK), Key Exchange Key (KEK), authorized signature database (db), and forbidden signature database (dbx).

Integrity Attestation and Verification

Once the operating system initializes, the system's state can be verified through local sealing or remote attestation.

In remote attestation, a verifier requests a "TPM Quote"—a cryptographically signed report of the current PCR values generated using an Attestation Identity Key (AIK) held inside the TPM. The verifier then replays the entries from the UEFI Event Log, hashing them sequentially to determine if the calculated value matches the signed PCR value from the TPM. If the values match, and the logged components match known-good reference measurements, the host confirms that the UEFI firmware executed without unauthorized modifications.