SecurityPkg: Skip PCR4 measurement for FV applications#1843
Open
apop5 wants to merge 1 commit into
Open
Conversation
Update DxeTpm2MeasureBootLib to stop measuring EFI applications loaded from measured firmware volumes. TCG PC Client Platform Firmware Profile Specification 1.06 r52 defines PCR[4] as Boot Manager Code and Boot Attempts. In 3.3.4.5, the required EV_EFI_BOOT_SERVICES_APPLICATION event is for the UEFI application code described by the Boot#### variable during a boot attempt. Applications launched from measured firmware volumes are part of platform firmware execution, not a Boot#### boot-option handoff to boot manager code. The same spec separately treats platform firmware as part of the firmware trust chain measured outside the PCR[4] boot-attempt path, so skipping PCR[4] here is consistent with the spec's PCR role split.
Contributor
❌ QEMU Validation FailedSource Dependencies
Results
Workflow run: https://github.com/microsoft/mu_basecore/actions/runs/28831147705 This comment was automatically generated by the Mu QEMU PR Validation workflow. |
Flickdm
approved these changes
Jul 6, 2026
Collaborator
Author
|
This should be considered a draft for review and commenting |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Update DxeTpm2MeasureBootLib to stop measuring EFI applications loaded from measured firmware volumes.
TCG PC Client Platform Firmware Profile Specification 1.06 r52 defines PCR[4] as Boot Manager Code and Boot Attempts. In 3.3.4.5, the required EV_EFI_BOOT_SERVICES_APPLICATION event is for the UEFI application code described by the Boot#### variable during a boot attempt.
Applications launched from measured firmware volumes are part of platform firmware execution, not a Boot#### boot-option handoff to boot manager code. The same spec separately treats platform firmware as part of the firmware trust chain measured outside the PCR[4] boot-attempt path, so skipping PCR[4] here is consistent with the spec's PCR role split.
How This Was Tested
Tested Q35 boot, dumping tcg log.
Integration Instructions
This is a breaking change in that it be reflected in the PCR[4] measurements.
If an OS is bound to PCR[4], efi applications launched from Fvs will no longer show up in the log, and may trigger bitlocker recovery.