MsvmPkg: add DisableSha1Pcr config flag to mask SHA-1 from TPM PCRs - #99
Open
Mike Ebersol (mebersol) wants to merge 1 commit into
Open
MsvmPkg: add DisableSha1Pcr config flag to mask SHA-1 from TPM PCRs#99Mike Ebersol (mebersol) wants to merge 1 commit into
Mike Ebersol (mebersol) wants to merge 1 commit into
Conversation
Mike Ebersol (mebersol)
force-pushed
the
feature/disable-sha1-pcd
branch
2 times, most recently
from
August 20, 2026 15:38
18b9a2d to
41b6b5b
Compare
Add a DisableSha1Pcr UEFI config flag that, when set by the host, clears the SHA-1 bank from PcdTpm2HashMask at PEI time. Follows the existing DisableSha384Pcr pattern.
Mike Ebersol (mebersol)
force-pushed
the
feature/disable-sha1-pcd
branch
from
August 20, 2026 15:40
41b6b5b to
ca023f6
Compare
Collaborator
|
Should we not just remove all instances of |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
DisableSha1PcrUEFI config flag that, when set by the host, removes the SHA-1 bank from the TPM PCR hash mask (PcdTpm2HashMask) at PEI time.This follows the existing
DisableSha384Pcrpattern.Changes
HvSintEnabledbit inUEFI_CONFIG_FLAGSasDisableSha1Pcr. No new bit is consumed andReservedis unchanged, so the surrounding flag layout/ABI is preserved.ConfigSetUefiConfigFlags, when the flag is set, clearHASH_ALG_SHA1fromPcdTpm2HashMaskviaPcdSet32S(sameMDE_CPU_X64guard as the SHA-384 path); plus a matchingDEBUG_VERBOSElog line.The dynamic PCD
gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMaskis already declared inPlatformPei.inf, so no INF/DSC changes are required.Notes
Default behavior is unchanged (flag defaults to 0). Effective only on X64, matching the existing SHA-384 measured-boot config path.