Host Platform Configuration (PCR 1) Interpretation Guide

Introduction

Platform Configuration Register 1 (PCR 1) is designated for measuring Host Platform Configuration data. For a PCR 1 measurement to be stable across boots, the underlying configuration data must be statically configured and unchangeable between boots. Any dynamic or variable data will cause the PCR 1 value to change. The following table provides a comprehensive list of events typically measured into PCR 1 based on “TCG PC Client Platform Firmware Profile Specification Level 00 Version 1.06 Revision 52 Family “2.0”. Note that not all OEMs or firmware implementations strictly adhere to specification guidelines, and some may not record all of the listed events in PCR 1. Therefore, without access to both the pre- and post-change TPM event logs, it can be challenging to accurately identify the specific cause of a change. The most common cause is a modification in the boot order, often triggered by inserting or removing a bootable device. For background on how PCR 1 is affected by BIOS settings, see Factors Affecting PCR[1].

Events Measured Into PCR 1

Measured Component or Event	Description
CPU Microcode	Measurement of the Microcode or Microcode Firmware Volume (FV). A change in the individually-used microcode patch loaded at runtime will change this measurement.
SMBIOS Table (Filtered Data)	Measurement of the SMBIOS table. Changes to the measured portions of the SMBIOS configuration data — excluding dynamic or unique instance data like `SerialNumber` or `WakeupType` — will change the digest.
Setup Configuration Data	Measurement of security-related configuration data from non-volatile storage, such as UEFI setup variables or CMOS. Changes to OEM-specific data or policy configurations will alter the measurement.
UEFI Boot Variables	Measurement of UEFI boot-related variables, such as `Boot####` and `BootOrder`, using `EV_EFI_VARIABLE_BOOT` or `EV_EFI_VARIABLE_BOOT2`. Changes to the boot order or boot options will change PCR 1.
Hardware Device List	Measurement of the hardware device list using `EV_TABLE_OF_DEVICES`. Changes in the presence or enumeration of devices on the platform will affect this measurement.
Non-Host Platform Configuration	Measurement of non-host platform configuration using `EV_NONHOST_CONFIG`, if the configuration can only be updated by the platform firmware. A firmware update or manual change to this restricted configuration data would change PCR 1.
Entering ROM Based Setup Action	Measurement of the action “Entering ROM Based Setup” with `EV_ACTION` for a setup utility. If a platform is configured to measure this action, entering the BIOS setup utility will change the PCR 1 measurement chain compared to a normal boot that bypasses setup.
Configurable Measurement Flags	Measurement of which optional PCR measurements (for example, SMBIOS, BIS Certificate, ESCD) are currently enabled or disabled, recorded via `EV_PLATFORM_CONFIG_FLAGS`. Toggling these settings changes the measurement for PCR 1.
UEFI Policy Variables (Deployed/Audit Mode)	Measurement of `DeployedMode` and `AuditMode` variable values (UEFI 2.5 and later). Applies if the platform supports changing these variables between initial measurement and `ExitBootServices()`.
Error Status Cap / Separator	Extension of digest value `00000001h` into PCR 1 with an `EV_SEPARATOR` event if a platform error occurs during initialization (for example, failure recording SRTM, POST BIOS, or Embedded Option ROMs). This caps the PCR to an invalid state.
TPM Hiding / Disabling	If the TPM transitions to a state where it is hidden or disabled per firmware policy, PCRs are capped with a digest of `00000000h` or `FFFFFFFFh` prior to the Ready to Boot call.

Next Steps

TPM PCR Index Security Implications

Full reference for all PCR indexes used by EVE-OS.

Trusted Platform Module (TPM) Overview

How EVE-OS uses the TPM for hardware-anchored security.

Remote Attestation Overview

How EVE-OS validates node integrity using the TPM.

Start Here

Infrastructure Services Overview

Core infrastructure

Build

Applications and delivery

Edge Kubernetes

Operations

Monitor

Administration and Security

Troubleshooting

Partnerships

Host Platform Configuration (PCR 1) Interpretation Guide

Introduction

Events Measured Into PCR 1

Next Steps

TPM PCR Index Security Implications

Trusted Platform Module (TPM) Overview

Remote Attestation Overview

​Introduction

​Events Measured Into PCR 1

​Next Steps

TPM PCR Index Security Implications

Trusted Platform Module (TPM) Overview

Remote Attestation Overview

Introduction

Events Measured Into PCR 1

Next Steps