public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
From: "Guomin Jiang" <guomin.jiang@intel.com>
To: devel@edk2.groups.io
Cc: Jiewen Yao <jiewen.yao@intel.com>,
	Jian J Wang <jian.j.wang@intel.com>,
	Chao Zhang <chao.b.zhang@intel.com>,
	Qi Zhang <qi1.zhang@intel.com>,
	Rahul Kumar <rahul1.kumar@intel.com>
Subject: [PATCH v4 9/9] SecurityPkg/TcgPei: Use Migrated FV Info Hob for calculating hash (CVE-2019-11098)
Date: Wed,  8 Jul 2020 16:10:59 +0800	[thread overview]
Message-ID: <20200708081059.691-10-guomin.jiang@intel.com> (raw)
In-Reply-To: <20200708081059.691-1-guomin.jiang@intel.com>

REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1614

When we allocate pool to save rebased the PEIMs, the address will change
randomly, therefore the hash will change and result PCR0 change as well.
To avoid this, we save the raw PEIMs and use it to calculate hash.
The TcgPei calculate the hash and it use the Migrated FV Info.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Qi Zhang <qi1.zhang@intel.com>
Cc: Rahul Kumar <rahul1.kumar@intel.com>
Signed-off-by: Guomin Jiang <guomin.jiang@intel.com>
---
 SecurityPkg/Tcg/TcgPei/TcgPei.inf |  1 +
 SecurityPkg/Tcg/TcgPei/TcgPei.c   | 29 +++++++++++++++++++++++++++--
 2 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/SecurityPkg/Tcg/TcgPei/TcgPei.inf b/SecurityPkg/Tcg/TcgPei/TcgPei.inf
index c0bff6e85e9d..6d1951f8ed65 100644
--- a/SecurityPkg/Tcg/TcgPei/TcgPei.inf
+++ b/SecurityPkg/Tcg/TcgPei/TcgPei.inf
@@ -58,6 +58,7 @@ [Guids]
   gTpmErrorHobGuid                                                    ## SOMETIMES_PRODUCES     ## HOB
   gMeasuredFvHobGuid                                                  ## PRODUCES               ## HOB
   gEfiTpmDeviceInstanceTpm12Guid                                      ## PRODUCES               ## GUID       # TPM device identifier
+  gEdkiiMigratedFvInfoGuid                                            ## SOMETIMES_CONSUMES     ## HOB
 
 [Ppis]
   gPeiLockPhysicalPresencePpiGuid                                     ## SOMETIMES_CONSUMES     ## NOTIFY
diff --git a/SecurityPkg/Tcg/TcgPei/TcgPei.c b/SecurityPkg/Tcg/TcgPei/TcgPei.c
index a9a808c9ecf3..9701bfe8715b 100644
--- a/SecurityPkg/Tcg/TcgPei/TcgPei.c
+++ b/SecurityPkg/Tcg/TcgPei/TcgPei.c
@@ -21,6 +21,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #include <Guid/TcgEventHob.h>
 #include <Guid/MeasuredFvHob.h>
 #include <Guid/TpmInstance.h>
+#include <Guid/MigratedFvInfo.h>
 
 #include <Library/DebugLib.h>
 #include <Library/BaseMemoryLib.h>
@@ -378,6 +379,10 @@ MeasureFvImage (
   EFI_STATUS                        Status;
   EFI_PLATFORM_FIRMWARE_BLOB        FvBlob;
   TCG_PCR_EVENT_HDR                 TcgEventHdr;
+  EFI_PHYSICAL_ADDRESS              FvOrgBase;
+  EFI_PHYSICAL_ADDRESS              FvDataBase;
+  EFI_PEI_HOB_POINTERS              Hob;
+  EDKII_MIGRATED_FV_INFO            *MigratedFvInfo;
 
   //
   // Check if it is in Excluded FV list
@@ -401,10 +406,30 @@ MeasureFvImage (
     }
   }
 
+  //
+  // Search the matched migration FV info
+  //
+  FvOrgBase  = FvBase;
+  FvDataBase = FvBase;
+  Hob.Raw  = GetFirstGuidHob (&gEdkiiMigratedFvInfoGuid);
+  while (Hob.Raw != NULL) {
+    MigratedFvInfo = GET_GUID_HOB_DATA (Hob);
+    if ((MigratedFvInfo->FvNewBase == (UINT32) FvBase) && (MigratedFvInfo->FvLength == (UINT32) FvLength)) {
+      //
+      // Found the migrated FV info
+      //
+      FvOrgBase  = (EFI_PHYSICAL_ADDRESS) (UINTN) MigratedFvInfo->FvOrgBase;
+      FvDataBase = (EFI_PHYSICAL_ADDRESS) (UINTN) MigratedFvInfo->FvDataBase;
+      break;
+    }
+    Hob.Raw = GET_NEXT_HOB (Hob);
+    Hob.Raw = GetNextGuidHob (&gEdkiiMigratedFvInfoGuid, Hob.Raw);
+  }
+
   //
   // Measure and record the FV to the TPM
   //
-  FvBlob.BlobBase   = FvBase;
+  FvBlob.BlobBase   = FvOrgBase;
   FvBlob.BlobLength = FvLength;
 
   DEBUG ((DEBUG_INFO, "The FV which is measured by TcgPei starts at: 0x%x\n", FvBlob.BlobBase));
@@ -416,7 +441,7 @@ MeasureFvImage (
 
   Status = HashLogExtendEvent (
              (EFI_PEI_SERVICES **) GetPeiServicesTablePointer(),
-             (UINT8*) (UINTN) FvBlob.BlobBase,
+             (UINT8*) (UINTN) FvDataBase,
              (UINTN) FvBlob.BlobLength,
              &TcgEventHdr,
              (UINT8*) &FvBlob
-- 
2.25.1.windows.1


      parent reply	other threads:[~2020-07-08  8:11 UTC|newest]

Thread overview: 17+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-07-08  8:10 [PATCH v4 0/9] Add new feature that evacuate temporary to permanent memory (CVE-2019-11098) Guomin Jiang
2020-07-08  8:10 ` [PATCH v4 1/9] MdeModulePkg: Add new PCD to control the evacuate temporary memory feature (CVE-2019-11098) Guomin Jiang
2020-07-08 17:03   ` [edk2-devel] " Laszlo Ersek
2020-07-08  8:10 ` [PATCH v4 2/9] MdeModulePkg/PeiCore: Enable T-RAM evacuation in PeiCore (CVE-2019-11098) Guomin Jiang
2020-07-08 17:13   ` [edk2-devel] " Laszlo Ersek
2020-07-08  8:10 ` [PATCH v4 3/9] UefiCpuPkg/CpuMpPei: Add GDT and IDT migration support (CVE-2019-11098) Guomin Jiang
2020-07-08 17:23   ` [edk2-devel] " Laszlo Ersek
2020-07-08  8:10 ` [PATCH v4 4/9] UefiCpuPkg/SecMigrationPei: Add initial PEIM (CVE-2019-11098) Guomin Jiang
2020-07-08 17:35   ` [edk2-devel] " Laszlo Ersek
2020-07-08  8:10 ` [PATCH v4 5/9] MdeModulePkg/Core: Create Migrated FV Info Hob for calculating hash (CVE-2019-11098) Guomin Jiang
2020-07-08 17:29   ` [edk2-devel] " Laszlo Ersek
2020-07-08  8:10 ` [PATCH v4 6/9] SecurityPkg/Tcg2Pei: Use " Guomin Jiang
2020-07-08  8:10 ` [PATCH v4 7/9] UefiCpuPkg/CpuMpPei: Enable paging and set NP flag to avoid TOCTOU (CVE-2019-11098) Guomin Jiang
2020-07-08 17:54   ` [edk2-devel] " Laszlo Ersek
2020-07-08  8:10 ` [PATCH v4 8/9] UefiCpuPkg: Correct some typos Guomin Jiang
2020-07-08 18:02   ` [edk2-devel] " Laszlo Ersek
2020-07-08  8:10 ` Guomin Jiang [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-list from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200708081059.691-10-guomin.jiang@intel.com \
    --to=devel@edk2.groups.io \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox