From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga07.intel.com (mga07.intel.com [134.134.136.100]) by mx.groups.io with SMTP id smtpd.web12.14243.1594623942351660848 for ; Mon, 13 Jul 2020 00:05:42 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@intel.onmicrosoft.com header.s=selector2-intel-onmicrosoft-com header.b=tFubjvbt; spf=pass (domain: intel.com, ip: 134.134.136.100, mailfrom: jian.j.wang@intel.com) IronPort-SDR: E1B+limLHSfZxWYKU1LT9AzeBPz4ebfNs8wljVyWG00XzxXZre9Av8mcBkZgJPTxLtD+y0fxUX 71cSnQA2/VEw== X-IronPort-AV: E=McAfee;i="6000,8403,9680"; a="213406248" X-IronPort-AV: E=Sophos;i="5.75,346,1589266800"; d="scan'208";a="213406248" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga008.jf.intel.com ([10.7.209.65]) by orsmga105.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 13 Jul 2020 00:05:41 -0700 IronPort-SDR: KGPP8ciHi0VzHoBgXj4KaiX5I5hOqr/B/hpl1b2ooavfDKr/GFYl05Jo5NXCgepVhJ6yrJXi1n 3EVZpO7hARzQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.75,346,1589266800"; d="scan'208";a="315974523" Received: from orsmsx104.amr.corp.intel.com ([10.22.225.131]) by orsmga008.jf.intel.com with ESMTP; 13 Jul 2020 00:05:41 -0700 Received: from orsmsx111.amr.corp.intel.com (10.22.240.12) by ORSMSX104.amr.corp.intel.com (10.22.225.131) with Microsoft SMTP Server (TLS) id 14.3.439.0; Mon, 13 Jul 2020 00:05:40 -0700 Received: from ORSEDG001.ED.cps.intel.com (10.7.248.4) by ORSMSX111.amr.corp.intel.com (10.22.240.12) with Microsoft SMTP Server (TLS) id 14.3.439.0; Mon, 13 Jul 2020 00:05:40 -0700 Received: from NAM11-DM6-obe.outbound.protection.outlook.com (104.47.57.169) by edgegateway.intel.com (134.134.137.100) with Microsoft SMTP Server (TLS) id 14.3.439.0; Mon, 13 Jul 2020 00:05:39 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=aiQYctclwRTLewL5Vp7vgr+LNI5s/x15/+EDJg85UA+AFfBXyVY6KC96QuO3P8ioJOz7XvC57vO6zIjKMHXhcr0wsBwQycyUCR97yPireMfDVaErlz12XhVtPsvMGV+zkbOendAEcC32w/lzWV5Lhd5q/LJBOTF1HJwKWXDhqamp484WKdIFI5ZOYhMwMTSQP9+LW0va7ivUwh/BflIJCAI8O6uLPd2EgX4fEAxTit1kxovLRR1CMmUYbmg6eErDm612CVeIsLwovZL2T5tIGys9QlUpOPVPhVkUgjrdZGj2+0uaPUEZy5gWTPkC1FFlr2bDKmMXO3tikkJZeFXgww== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=8KCum0+Zo7vB92Ttg2Ss0zZZFPFATEEKU7I54qj3WAk=; b=ijIm2eiq6FCrMh6WKps09IPyg+zXs5EGmL5ll5931hltfh3DC7WAwXLUKHSoDTYIzv0cXG4VeOP6azGQ6oL3NBZP+XgNhqSFN/1yfWp+k71g5c23+r8KqyTkbHAvZVF6obT2zCxlpy7uiGsXiA7Naj7lCHPD8+rYE5w73EIVyQjyTspM7WgodxeyeFjY5rMftYSKHmMM2RX+oS7CL3IV65w02FMpe3AgOgzfeE5OyEHyFktCE4najcootOrkSRvMKDb6eNoVQI/NIeu37WCU/aqpJEW5mgEnZzeuaU/sOW/1LbrMIZt9oyKcuZUCiK8PuhaSCP9D0YERjFgaW04tXw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=intel.com; dmarc=pass action=none header.from=intel.com; dkim=pass header.d=intel.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=intel.onmicrosoft.com; s=selector2-intel-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=8KCum0+Zo7vB92Ttg2Ss0zZZFPFATEEKU7I54qj3WAk=; b=tFubjvbtaZziyMa6ftBX96U1HFVU6dsgFXbBlRRhI7TWmP3LGw/N7PGdueT4ejS76AcZ37BOb3jobgg6GCYyhaoZo/UU4NQVlKQEAghPEf4HpgWvNnWvEHPT2T28LdRgQY6MwxAv9aCmLosd0fXmwL6tQbrNwxlsr/5G/mQjoJQ= Received: from SN6PR11MB3312.namprd11.prod.outlook.com (2603:10b6:805:c8::14) by SN6PR11MB2608.namprd11.prod.outlook.com (2603:10b6:805:57::29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3174.24; Mon, 13 Jul 2020 07:05:38 +0000 Received: from SN6PR11MB3312.namprd11.prod.outlook.com ([fe80::31f6:24c6:99f0:33d2]) by SN6PR11MB3312.namprd11.prod.outlook.com ([fe80::31f6:24c6:99f0:33d2%6]) with mapi id 15.20.3174.025; Mon, 13 Jul 2020 07:05:38 +0000 From: "Wang, Jian J" To: "Jiang, Guomin" , "devel@edk2.groups.io" CC: "Wu, Hao A" , "Bi, Dandan" , "Gao, Liming" , "De, Debkumar" , "Han, Harry" , "West, Catharine" , Laszlo Ersek Subject: Re: [PATCH v5 5/9] MdeModulePkg/Core: Create Migrated FV Info Hob for calculating hash (CVE-2019-11098) Thread-Topic: [PATCH v5 5/9] MdeModulePkg/Core: Create Migrated FV Info Hob for calculating hash (CVE-2019-11098) Thread-Index: AQHWVZRHoayiATeaK0CVtOgJO6XEVqkFGnqQ Date: Mon, 13 Jul 2020 07:05:38 +0000 Message-ID: References: <20200709015645.336-1-guomin.jiang@intel.com> <20200709015645.336-6-guomin.jiang@intel.com> In-Reply-To: <20200709015645.336-6-guomin.jiang@intel.com> Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiZTM5YmZkMjktODc4Yy00ZjkwLWFhNWUtZGYxZmI1ZTc2MzExIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoidVA3VGdZQTJJdGk2aWl5alBGT1lid200bExhd1YzeWE0YmVmMEdwWTRmSjhmNzNhWnVFelU0QXphd0d3M1wvak0ifQ== dlp-reaction: no-action dlp-version: 11.2.0.6 dlp-product: dlpe-windows x-ctpclassification: CTP_NT authentication-results: intel.com; dkim=none (message not signed) header.d=none;intel.com; dmarc=none action=none header.from=intel.com; x-originating-ip: [192.198.147.194] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 98f0605d-8215-4c2d-fd01-08d826fb25ec x-ms-traffictypediagnostic: SN6PR11MB2608: x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: jKiR2ucKa0LlLHVoU59+6xkEHCkm39b2IXFqBcwJiq547Ir+expyhYpv49e3IP/7ICp1sBu7iblHaCPN9FLwkLX3STIfOpLR7KEUcfbuo1qokCrbrkkaNDHymiBdcmF/gjb6lkOT5HzLVJWNOjHgtPn3v0DtV854aPEw6UtFLJ11sIB7gC5gOac61jpZGaD9c+RZF8i+5b/rNqxU9k7oFjWfFAULotddzEb7Rvy/SSwzeQ56ojtGHsB4itlRp39Dtg3Exl1yvaZfoNW0zk335UROCD+ea8FlOCz7zt+Yh6Xk9O05rYP3OQmPi9QKWd5Rx73pP3YD3Cx/kJDgKYo/xFsklfqcc5TQbZGBtiDjJprc8/FgFGkErDB7vrrZOXG/hhZybqJovEw0uvboh17+sw== x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SN6PR11MB3312.namprd11.prod.outlook.com;PTR:;CAT:NONE;SFTY:;SFS:(4636009)(136003)(346002)(396003)(366004)(39860400002)(376002)(110136005)(8676002)(2906002)(478600001)(83380400001)(316002)(5660300002)(4326008)(52536014)(19627235002)(9686003)(6506007)(53546011)(7696005)(8936002)(54906003)(86362001)(33656002)(66556008)(55016002)(186003)(66946007)(66446008)(26005)(64756008)(66476007)(76116006)(71200400001);DIR:OUT;SFP:1102; x-ms-exchange-antispam-messagedata: LQv0vDZakKjQANrg3eypKXSonmK1EIRdzo4yOixVZ6aKFB1N0A+zG1nUFX9H/7pbnW5AVSkZ5qWleNkHow1vz0vwHMqjaazv7gwMRiWPOfOG0Ms45gzkTxhBipcmY7By6U4DURJVlez3eRqIGrYifQZt7wLmEFTXtjsVwmVWDxD+3CbwS2LMVX7BHUpu5nZkwkMNE8fwXcaQKRKOtvpHdSl1pzBNi9AJ4Ew7RuMcw0Wm/Gzzhx2HccRUhvZuh0lsar+UCkAA1FG4jI97SpckL/wst2A/609o/DirqO9b8R26R0v280rJZ/SqPcycNyWElFUn55Fv+wnlaA7dkWeHy9fwjx/9SoqE98tEIWf3C9mfhgxlyaB9o9fTH12PvLcQee0+/IWu5l3oBWc+uABGeh4k6uDBDLokoq0bbpJNr4cbP/SuhVh5AfesxeLqnbcir22Z7EpeJpgRH+8a7TfhJpYwBsQYTsXKS5pCEi7ifeLvwYR3flkhAbT8+tBRrim/ MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SN6PR11MB3312.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 98f0605d-8215-4c2d-fd01-08d826fb25ec X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Jul 2020 07:05:38.6600 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: rtl15sPSK3kqKXGBwSYqHqhVJm/iN7JEBaXdM6S0qJQb7N4bZ1MYkldKsx4cednZ+qJtkRmUKGr+BwyDE6qCTg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR11MB2608 Return-Path: jian.j.wang@intel.com X-OriginatorOrg: intel.com Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Guomin, Some typo or syntax issues below. > -----Original Message----- > From: Jiang, Guomin > Sent: Thursday, July 09, 2020 9:57 AM > To: devel@edk2.groups.io > Cc: Wang, Jian J ; Wu, Hao A ; > Bi, Dandan ; Gao, Liming ; De, > Debkumar ; Han, Harry ; > West, Catharine ; Laszlo Ersek > Subject: [PATCH v5 5/9] MdeModulePkg/Core: Create Migrated FV Info Hob fo= r > calculating hash (CVE-2019-11098) >=20 > REF:https://bugzilla.tianocore.org/show_bug.cgi?id=3D1614 >=20 > When we allocate pool to save the rebased PEIMs, the address will change > randomly, therefore the hash will change and result PCR0 change as well. > To avoid this, we save the raw PEIMs and use it to calculate hash. >=20 > The MigratedFvInfo HOB will never produce when > PcdMigrateTemporaryRamFirmwareVolumes is FALSE, because the PCD control > the total feature. >=20 > Cc: Jian J Wang > Cc: Hao A Wu > Cc: Dandan Bi > Cc: Liming Gao > Cc: Debkumar De > Cc: Harry Han > Cc: Catharine West > Signed-off-by: Guomin Jiang > Acked-by: Laszlo Ersek > --- > MdeModulePkg/MdeModulePkg.dec | 3 ++ > MdeModulePkg/Core/Pei/PeiMain.inf | 1 + > MdeModulePkg/Core/Pei/PeiMain.h | 1 + > MdeModulePkg/Include/Guid/MigratedFvInfo.h | 22 +++++++++++++++ > MdeModulePkg/Core/Pei/Dispatcher/Dispatcher.c | 28 +++++++++++++++++++ > 5 files changed, 55 insertions(+) > create mode 100644 MdeModulePkg/Include/Guid/MigratedFvInfo.h >=20 > diff --git a/MdeModulePkg/MdeModulePkg.dec > b/MdeModulePkg/MdeModulePkg.dec > index 16db17d0a873..40197dba862c 100644 > --- a/MdeModulePkg/MdeModulePkg.dec > +++ b/MdeModulePkg/MdeModulePkg.dec > @@ -389,6 +389,9 @@ [Guids] > ## GUID indicates the capsule is to store Capsule On Disk file names. > gEdkiiCapsuleOnDiskNameGuid =3D { 0x98c80a4f, 0xe16b, 0x4d11, { 0x93, = 0x9a, > 0xab, 0xe5, 0x61, 0x26, 0x3, 0x30 } } >=20 > + ## Include/Guid/MigratedFvInfo.h > + gEdkiiMigratedFvInfoGuid =3D { 0xc1ab12f7, 0x74aa, 0x408d, { 0xa2, 0xf= 4, 0xc6, > 0xce, 0xfd, 0x17, 0x98, 0x71 } } > + > [Ppis] > ## Include/Ppi/AtaController.h > gPeiAtaControllerPpiGuid =3D { 0xa45e60d1, 0xc719, 0x44aa, { 0xb= 0, 0x7a, > 0xaa, 0x77, 0x7f, 0x85, 0x90, 0x6d }} > diff --git a/MdeModulePkg/Core/Pei/PeiMain.inf > b/MdeModulePkg/Core/Pei/PeiMain.inf > index 5b36d516b3fa..0cf357371a16 100644 > --- a/MdeModulePkg/Core/Pei/PeiMain.inf > +++ b/MdeModulePkg/Core/Pei/PeiMain.inf > @@ -77,6 +77,7 @@ [Guids] > ## CONSUMES ## GUID # Used to compare with FV's file system GUI= D and > get the FV's file system format > gEfiFirmwareFileSystem3Guid > gStatusCodeCallbackGuid > + gEdkiiMigratedFvInfoGuid ## SOMETIMES_PRODUCES = ## HOB >=20 > [Ppis] > gEfiPeiStatusCodePpiGuid ## SOMETIMES_CONSUMES # > PeiReportStatusService is not ready if this PPI doesn't exist > diff --git a/MdeModulePkg/Core/Pei/PeiMain.h > b/MdeModulePkg/Core/Pei/PeiMain.h > index b0101dba5e30..cbf74d5b9d9a 100644 > --- a/MdeModulePkg/Core/Pei/PeiMain.h > +++ b/MdeModulePkg/Core/Pei/PeiMain.h > @@ -44,6 +44,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent > #include > #include > #include > +#include >=20 > /// > /// It is an FFS type extension used for PeiFindFileEx. It indicates cur= rent > diff --git a/MdeModulePkg/Include/Guid/MigratedFvInfo.h > b/MdeModulePkg/Include/Guid/MigratedFvInfo.h > new file mode 100644 > index 000000000000..061c17ed0e48 > --- /dev/null > +++ b/MdeModulePkg/Include/Guid/MigratedFvInfo.h > @@ -0,0 +1,22 @@ > +/** @file > + Migrated FV information > + > +Copyright (c) 2020, Intel Corporation. All rights reserved.
> +SPDX-License-Identifier: BSD-2-Clause-Patent > + > +**/ > + > +#ifndef __EDKII_MIGRATED_FV_INFO_GUID_H__ > +#define __EDKII_MIGRATED_FV_INFO_GUID_H__ > + > +typedef struct { > + UINT32 FvOrgBase; // original FV address > + UINT32 FvNewBase; // new FV address > + UINT32 FvDataBase; // original FV data > + UINT32 FvLength; // Fv Length > +} EDKII_MIGRATED_FV_INFO; > + > +extern EFI_GUID gEdkiiMigratedFvInfoGuid; > + > +#endif // #ifndef __EDKII_MIGRATED_FV_INFO_GUID_H__ > + > diff --git a/MdeModulePkg/Core/Pei/Dispatcher/Dispatcher.c > b/MdeModulePkg/Core/Pei/Dispatcher/Dispatcher.c > index ef88b3423376..f654cea15c59 100644 > --- a/MdeModulePkg/Core/Pei/Dispatcher/Dispatcher.c > +++ b/MdeModulePkg/Core/Pei/Dispatcher/Dispatcher.c > @@ -1223,10 +1223,12 @@ EvacuateTempRam ( > EFI_FIRMWARE_VOLUME_HEADER *FvHeader; > EFI_FIRMWARE_VOLUME_HEADER *ChildFvHeader; > EFI_FIRMWARE_VOLUME_HEADER *MigratedFvHeader; > + EFI_FIRMWARE_VOLUME_HEADER *RawDataFvHeader; > EFI_FIRMWARE_VOLUME_HEADER *MigratedChildFvHeader; >=20 > PEI_CORE_FV_HANDLE PeiCoreFvHandle; > EFI_PEI_CORE_FV_LOCATION_PPI *PeiCoreFvLocationPpi; > + EDKII_MIGRATED_FV_INFO MigratedFvInfo; >=20 > ASSERT (Private->PeiMemoryInstalled); >=20 > @@ -1263,6 +1265,9 @@ EvacuateTempRam ( > (((EFI_PHYSICAL_ADDRESS)(UINTN) FvHeader + (FvHeader->FvLength -= 1)) < > Private->FreePhysicalMemoryTop) > ) > ) { > + // > + // Allocate page to save the rebased PEIMs, the PEIMs will get con= trol later Do you mean 'control' -> 'dispatched'? > + // > Status =3D PeiServicesAllocatePages ( > EfiBootServicesCode, > EFI_SIZE_TO_PAGES ((UINTN) FvHeader->FvLength), > @@ -1270,6 +1275,17 @@ EvacuateTempRam ( > ); > ASSERT_EFI_ERROR (Status); >=20 > + // > + // Allocate pool to save the raw PEIMs, it used to keep consistent= context > across > + // multiple boot and PCR0 will keep same no matter if allocate ran= dom page > address. Consider to revise the statement: 'no matter if ...' -> 'no matter if the address of allocated page is change= d' > + // > + Status =3D PeiServicesAllocatePages ( > + EfiBootServicesCode, > + EFI_SIZE_TO_PAGES ((UINTN) FvHeader->FvLength), > + (EFI_PHYSICAL_ADDRESS *) &RawDataFvHeader > + ); > + ASSERT_EFI_ERROR (Status); > + > DEBUG (( > DEBUG_VERBOSE, > " Migrating FV[%d] from 0x%08X to 0x%08X\n", > @@ -1278,7 +1294,19 @@ EvacuateTempRam ( > (UINTN) MigratedFvHeader > )); >=20 > + // > + // Copy the context to the rebased pages and raw pages, and create= hob to > save the > + // information. the MigratedFvInfo HOB will never produce when 'the' -> 'The' 'produce' -> 'be produced' Regards, Jian > + // PcdMigrateTemporaryRamFirmwareVolumes is FALSE, because the PCD > control the > + // feature. > + // > CopyMem (MigratedFvHeader, FvHeader, (UINTN) FvHeader->FvLength); > + CopyMem (RawDataFvHeader, MigratedFvHeader, (UINTN) FvHeader- > >FvLength); > + MigratedFvInfo.FvOrgBase =3D (UINT32) (UINTN) FvHeader; > + MigratedFvInfo.FvNewBase =3D (UINT32) (UINTN) MigratedFvHeader; > + MigratedFvInfo.FvDataBase =3D (UINT32) (UINTN) RawDataFvHeader; > + MigratedFvInfo.FvLength =3D (UINT32) (UINTN) FvHeader->FvLength; > + BuildGuidDataHob (&gEdkiiMigratedFvInfoGuid, &MigratedFvInfo, size= of > (MigratedFvInfo)); >=20 > // > // Migrate any children for this FV now > -- > 2.25.1.windows.1