From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-1.mimecast.com (us-smtp-1.mimecast.com [207.211.31.120]) by mx.groups.io with SMTP id smtpd.web11.11206.1593786211547061109 for ; Fri, 03 Jul 2020 07:23:31 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=V5mPvxc4; spf=pass (domain: redhat.com, ip: 207.211.31.120, mailfrom: lersek@redhat.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1593786210; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=aUcwYCdxypOxxAWCMP/wuEOSwSd9aHZOCnS328mhy4o=; b=V5mPvxc4zEF3M4v7yeLlUYG/15+KjGU0ZaQ6Ij/XR9EaOX6gWpJJthmrwnS7iwQw72UHsD m8M5MD3lnybuOU/ETDQsneQJ8gCNqcxrkut5ZWu2PprbP62GzdpaTY7Qp9ryqYb2BBtgJs VWzrmxLXKHtB4HjHZMj/Bxfh2UxB0wo= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-369-8LVqWCRkNsWqO8zpYk7hEQ-1; Fri, 03 Jul 2020 10:23:22 -0400 X-MC-Unique: 8LVqWCRkNsWqO8zpYk7hEQ-1 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id B9A0E800401; Fri, 3 Jul 2020 14:23:20 +0000 (UTC) Received: from lacos-laptop-7.usersys.redhat.com (ovpn-114-238.ams2.redhat.com [10.36.114.238]) by smtp.corp.redhat.com (Postfix) with ESMTP id 1AFDE7BD5E; Fri, 3 Jul 2020 14:23:18 +0000 (UTC) Subject: Re: [edk2-devel] [PATCH v2 4/9] MdeModulePkg/DxeIplPeim: Register for shadow on S3 shadowed boot (CVE-2019-11098) From: "Laszlo Ersek" To: devel@edk2.groups.io, guomin.jiang@intel.com Cc: Jian J Wang , Hao A Wu , Dandan Bi , Liming Gao References: <20200702051525.1102-1-guomin.jiang@intel.com> <20200702051525.1102-5-guomin.jiang@intel.com> Message-ID: Date: Fri, 3 Jul 2020 16:23:18 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=lersek@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Language: en-US Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit On 07/03/20 16:00, Laszlo Ersek wrote: > On 07/02/20 07:15, Guomin Jiang wrote: >> From: Jian J Wang >> >> REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1614 >> >> Cc: Jian J Wang >> Cc: Hao A Wu >> Cc: Dandan Bi >> Cc: Liming Gao >> Signed-off-by: Jian J Wang >> --- >> MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf | 3 +++ >> MdeModulePkg/Core/DxeIplPeim/DxeLoad.c | 2 +- >> 2 files changed, 4 insertions(+), 1 deletion(-) > > (1) The commit message is empty, and therefore useless. Please explain > why this change is being made. > >> diff --git a/MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf b/MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf >> index 3f1702854660..4ab54594ed66 100644 >> --- a/MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf >> +++ b/MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf >> @@ -121,6 +121,9 @@ [Pcd.IA32,Pcd.X64,Pcd.ARM,Pcd.AARCH64] >> gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy ## SOMETIMES_CONSUMES >> gEfiMdeModulePkgTokenSpaceGuid.PcdImageProtectionPolicy ## SOMETIMES_CONSUMES >> >> +[Pcd] >> + gEfiMdeModulePkgTokenSpaceGuid.PcdShadowPeimOnS3Boot ## CONSUMES >> + >> [Depex] >> gEfiPeiLoadFilePpiGuid AND gEfiPeiMasterBootModePpiGuid >> >> diff --git a/MdeModulePkg/Core/DxeIplPeim/DxeLoad.c b/MdeModulePkg/Core/DxeIplPeim/DxeLoad.c >> index d48028cea0dd..9e1831c69819 100644 >> --- a/MdeModulePkg/Core/DxeIplPeim/DxeLoad.c >> +++ b/MdeModulePkg/Core/DxeIplPeim/DxeLoad.c >> @@ -77,7 +77,7 @@ PeimInitializeDxeIpl ( >> >> BootMode = GetBootModeHob (); >> >> - if (BootMode != BOOT_ON_S3_RESUME) { >> + if (BootMode != BOOT_ON_S3_RESUME || PcdGetBool (PcdShadowPeimOnS3Boot)) { >> Status = PeiServicesRegisterForShadow (FileHandle); >> if (Status == EFI_SUCCESS) { >> // >> > > (2) The above check does not seem complete. I think it should consider > "PcdMigrateTemporaryRamFirmwareVolumes". > > I don't exactly understand the impact of the change, but it seems to > potentially affect even such platforms that set > "PcdMigrateTemporaryRamFirmwareVolumes" to FALSE; and that seems wrong. ... On further consideration, this patch seems to be fixing a preexistent bug that is not related to the CVE at all. I think this issue was simply exposed when testing the new feature. Is that right? If that's correct, then please explain this very clearly in the commit message. Thanks, Laszlo