PCR
A TPM register that can only be extended, never set, accumulating a hash chain of everything measured during boot.
A PCR starts at zero on reset and changes only by extend: PCR_new = H(PCR_old || H(measurement)). Order matters and nothing can be undone, so the final value commits to the exact sequence of components loaded. TPM 2.0 has 24 PCRs per hash bank (SHA-1, SHA-256).
Conventions on PC platforms: PCR 0 firmware code, PCR 2 option ROMs, PCR 4 boot manager, PCR 7 Secure Boot state and certificates, higher PCRs used by the OS (Linux systemd-boot and unified kernel images use PCR 11 for the kernel image). Sealing to PCR 7 survives kernel updates; sealing to PCR 4 or 11 breaks on every update unless you predict and pre-sign the values.
The event log records what was extended so a verifier can replay it and check it reproduces the quoted PCRs. Firmware updates changing PCR 0 are the classic cause of unexpected BitLocker recovery prompts.
tpm2_pcrread sha256:0,4,7
systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 /dev/nvme0n1p3