From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga09.intel.com (mga09.intel.com []) by mx.groups.io with SMTP id smtpd.web10.2987.1595584489166956048 for ; Fri, 24 Jul 2020 02:55:08 -0700 Authentication-Results: mx.groups.io; dkim=missing; spf=fail (domain: intel.com, ip: , mailfrom: guomin.jiang@intel.com) IronPort-SDR: raWRweJ01nlVeGRz7ymK5k0mfJD814JG0vH1cq17/vQgXYxUvHIjO4VFNy2s6VaFKzoZFlEjtK UZJynvR5upXQ== X-IronPort-AV: E=McAfee;i="6000,8403,9691"; a="151974006" X-IronPort-AV: E=Sophos;i="5.75,390,1589266800"; d="scan'208";a="151974006" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga008.jf.intel.com ([10.7.209.65]) by orsmga102.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Jul 2020 02:55:07 -0700 IronPort-SDR: RMjIPX1u/ZXu5c2/aGywlnY01clJ5SAz1TfI9tUs1qbLovk/IUa6wwjK6E9PXbP3WDqBW/fKy2 zRqrTv8nJ4IA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.75,390,1589266800"; d="scan'208";a="319266362" Received: from guominji-mobl.ccr.corp.intel.com ([10.238.13.140]) by orsmga008.jf.intel.com with ESMTP; 24 Jul 2020 02:55:05 -0700 From: "Guomin Jiang" To: devel@edk2.groups.io Cc: Jiewen Yao , Jian J Wang , Chao Zhang , Qi Zhang , Rahul Kumar Subject: [PATCH v8 9/9] SecurityPkg/TcgPei: Use Migrated FV Info Hob for calculating hash (CVE-2019-11098) Date: Fri, 24 Jul 2020 17:54:46 +0800 Message-Id: <20200724095446.598-10-guomin.jiang@intel.com> X-Mailer: git-send-email 2.25.1.windows.1 In-Reply-To: <20200724095446.598-1-guomin.jiang@intel.com> References: <20200724095446.598-1-guomin.jiang@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1614 When we allocate pool to save rebased the PEIMs, the address will change randomly, therefore the hash will change and result PCR0 change as well. To avoid this, we save the raw PEIMs and use it to calculate hash. The TcgPei calculate the hash and it use the Migrated FV Info. Cc: Jiewen Yao Cc: Jian J Wang Cc: Chao Zhang Cc: Qi Zhang Cc: Rahul Kumar Signed-off-by: Guomin Jiang Reviewed-by: Jian J Wang Reviewed-by: Qi Zhang --- SecurityPkg/Tcg/TcgPei/TcgPei.inf | 1 + SecurityPkg/Tcg/TcgPei/TcgPei.c | 29 +++++++++++++++++++++++++++-- 2 files changed, 28 insertions(+), 2 deletions(-) diff --git a/SecurityPkg/Tcg/TcgPei/TcgPei.inf b/SecurityPkg/Tcg/TcgPei/TcgPei.inf index 4ab4edd657c0..2e3e7e0575d5 100644 --- a/SecurityPkg/Tcg/TcgPei/TcgPei.inf +++ b/SecurityPkg/Tcg/TcgPei/TcgPei.inf @@ -58,6 +58,7 @@ [Guids] gTpmErrorHobGuid ## SOMETIMES_PRODUCES ## HOB gMeasuredFvHobGuid ## PRODUCES ## HOB gEfiTpmDeviceInstanceTpm12Guid ## PRODUCES ## GUID # TPM device identifier + gEdkiiMigratedFvInfoGuid ## SOMETIMES_CONSUMES ## HOB [Ppis] gPeiLockPhysicalPresencePpiGuid ## SOMETIMES_CONSUMES ## NOTIFY diff --git a/SecurityPkg/Tcg/TcgPei/TcgPei.c b/SecurityPkg/Tcg/TcgPei/TcgPei.c index 253338884907..db33daed3723 100644 --- a/SecurityPkg/Tcg/TcgPei/TcgPei.c +++ b/SecurityPkg/Tcg/TcgPei/TcgPei.c @@ -22,6 +22,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include #include #include +#include #include #include @@ -422,6 +423,10 @@ MeasureFvImage ( EFI_STATUS Status; EFI_PLATFORM_FIRMWARE_BLOB FvBlob; TCG_PCR_EVENT_HDR TcgEventHdr; + EFI_PHYSICAL_ADDRESS FvOrgBase; + EFI_PHYSICAL_ADDRESS FvDataBase; + EFI_PEI_HOB_POINTERS Hob; + EDKII_MIGRATED_FV_INFO *MigratedFvInfo; // // Check if it is in Excluded FV list @@ -445,10 +450,30 @@ MeasureFvImage ( } } + // + // Search the matched migration FV info + // + FvOrgBase = FvBase; + FvDataBase = FvBase; + Hob.Raw = GetFirstGuidHob (&gEdkiiMigratedFvInfoGuid); + while (Hob.Raw != NULL) { + MigratedFvInfo = GET_GUID_HOB_DATA (Hob); + if ((MigratedFvInfo->FvNewBase == (UINT32) FvBase) && (MigratedFvInfo->FvLength == (UINT32) FvLength)) { + // + // Found the migrated FV info + // + FvOrgBase = (EFI_PHYSICAL_ADDRESS) (UINTN) MigratedFvInfo->FvOrgBase; + FvDataBase = (EFI_PHYSICAL_ADDRESS) (UINTN) MigratedFvInfo->FvDataBase; + break; + } + Hob.Raw = GET_NEXT_HOB (Hob); + Hob.Raw = GetNextGuidHob (&gEdkiiMigratedFvInfoGuid, Hob.Raw); + } + // // Measure and record the FV to the TPM // - FvBlob.BlobBase = FvBase; + FvBlob.BlobBase = FvOrgBase; FvBlob.BlobLength = FvLength; DEBUG ((DEBUG_INFO, "The FV which is measured by TcgPei starts at: 0x%x\n", FvBlob.BlobBase)); @@ -461,7 +486,7 @@ MeasureFvImage ( Status = HashLogExtendEvent ( &mEdkiiTcgPpi, 0, - (UINT8*) (UINTN) FvBlob.BlobBase, + (UINT8*) (UINTN) FvDataBase, (UINTN) FvBlob.BlobLength, &TcgEventHdr, (UINT8*) &FvBlob -- 2.25.1.windows.1