From nobody Mon Feb 9 12:26:24 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) client-ip=66.175.222.12; envelope-from=bounce+27952+62223+1787277+3901457@groups.io; helo=web01.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) smtp.mailfrom=bounce+27952+62223+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1594195875; cv=none; d=zohomail.com; s=zohoarc; b=TbzVFzwDJMt+iSWDIei1HkpYakKNJZwIImWWSS0OAKG6/E+2q/ul7J/0aOdwoxFpcKykJaHxkFvDZQVHKwh6/159pM29gUNIHQIhygRo/wwaCSl9wk4C3str0nEarUOFUOlfbHMS4z6T9XnlvRVBr1g029l/MeW2g01tsKj6etg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1594195875; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Id:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=egASx0+HOrJC9IYyEEIl5OTU4oXWiJIlm5uJoOsyMtU=; b=d4Nrbtc8H9ZNuwWIRIjtPoCYrJAcQM/mj4OJ5M+mYJxMVqp9N+8Un9Gu94sQmayR+J/s5tzqZo5dK0Rl1o8MU8+W+1vJ5qWejd+SJAXL1bMpsd9Xj7Hp7GD9V2ZMRWs61bmI0nC1rtbT0AnKcAtRaCQEoWjMRDE4PlE9WVmS5P8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) smtp.mailfrom=bounce+27952+62223+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) header.from= Received: from web01.groups.io (web01.groups.io [66.175.222.12]) by mx.zohomail.com with SMTPS id 1594195875653935.3004325099708; Wed, 8 Jul 2020 01:11:15 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id BlsJYY1788612x8tU1jrJ7G9; Wed, 08 Jul 2020 01:11:15 -0700 X-Received: from mga14.intel.com (mga14.intel.com []) by mx.groups.io with SMTP id smtpd.web10.6162.1594195868464323810 for ; Wed, 08 Jul 2020 01:11:14 -0700 IronPort-SDR: sYnilKit1sTHs4I/nPPbo4REQndzJVLuCMXILmkDWNmfH/aLhPJpcnmm6/dJvGH7Zwf3lCdP/A 5DdHsikfMRrg== X-IronPort-AV: E=McAfee;i="6000,8403,9675"; a="146826626" X-IronPort-AV: E=Sophos;i="5.75,327,1589266800"; d="scan'208";a="146826626" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-Received: from fmsmga006.fm.intel.com ([10.253.24.20]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 Jul 2020 01:11:14 -0700 IronPort-SDR: hIkXY4dg/1//XBon74/9+lb3nN9epQB6n2Ys+3wsWpUVFLvhV9mY/gu0qyq0ch4UbyytUcbI2A Z6ORcE9vAS4w== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.75,327,1589266800"; d="scan'208";a="483347265" X-Received: from guominji-mobl.ccr.corp.intel.com ([10.238.4.95]) by fmsmga006.fm.intel.com with ESMTP; 08 Jul 2020 01:11:12 -0700 From: "Guomin Jiang" To: devel@edk2.groups.io Cc: Jian J Wang , Hao A Wu , Dandan Bi , Liming Gao , Debkumar De , Harry Han , Catharine West Subject: [edk2-devel] [PATCH v4 5/9] MdeModulePkg/Core: Create Migrated FV Info Hob for calculating hash (CVE-2019-11098) Date: Wed, 8 Jul 2020 16:10:55 +0800 Message-Id: <20200708081059.691-6-guomin.jiang@intel.com> In-Reply-To: <20200708081059.691-1-guomin.jiang@intel.com> References: <20200708081059.691-1-guomin.jiang@intel.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,guomin.jiang@intel.com X-Gm-Message-State: EIUebsi8uuuOAWGJOyjnWEbix1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1594195875; bh=x5IMjVDGnpCHrH2GjdgZuRf8AV2bboW4vOZtsxKIlkI=; h=Cc:Date:From:Reply-To:Subject:To; b=J9R1VtyKJC5lTFPZNTAleGT2qpYZiMseZB3nAGNwTMzCWMjOWwDavcycllV7EUXoDIf yY1yfu0hGekJ4XMp38mnInUxSkqc5CxDR38nrzlU5sJjPLNddcf0J9+iMooMY5AbFJBUH C/CsGHDvqteMHV18FeEwdYQFm00RjGE94kA= X-ZohoMail-DKIM: pass (identity @groups.io) Content-Type: text/plain; charset="utf-8" REF:https://bugzilla.tianocore.org/show_bug.cgi?id=3D1614 When we allocate pool to save the rebased PEIMs, the address will change randomly, therefore the hash will change and result PCR0 change as well. To avoid this, we save the raw PEIMs and use it to calculate hash. The MigratedFvInfo HOB will never produce when PcdMigrateTemporaryRamFirmwareVolumes is FALSE, because the PCD control the total feature. Cc: Jian J Wang Cc: Hao A Wu Cc: Dandan Bi Cc: Liming Gao Cc: Debkumar De Cc: Harry Han Cc: Catharine West Signed-off-by: Guomin Jiang Acked-by: Laszlo Ersek --- MdeModulePkg/MdeModulePkg.dec | 3 ++ MdeModulePkg/Core/Pei/PeiMain.inf | 1 + MdeModulePkg/Core/Pei/PeiMain.h | 1 + MdeModulePkg/Include/Guid/MigratedFvInfo.h | 22 +++++++++++++++ MdeModulePkg/Core/Pei/Dispatcher/Dispatcher.c | 28 +++++++++++++++++++ 5 files changed, 55 insertions(+) create mode 100644 MdeModulePkg/Include/Guid/MigratedFvInfo.h diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec index 16db17d0a873..40197dba862c 100644 --- a/MdeModulePkg/MdeModulePkg.dec +++ b/MdeModulePkg/MdeModulePkg.dec @@ -389,6 +389,9 @@ [Guids] ## GUID indicates the capsule is to store Capsule On Disk file names. gEdkiiCapsuleOnDiskNameGuid =3D { 0x98c80a4f, 0xe16b, 0x4d11, { 0x93, 0x= 9a, 0xab, 0xe5, 0x61, 0x26, 0x3, 0x30 } } =20 + ## Include/Guid/MigratedFvInfo.h + gEdkiiMigratedFvInfoGuid =3D { 0xc1ab12f7, 0x74aa, 0x408d, { 0xa2, 0xf4,= 0xc6, 0xce, 0xfd, 0x17, 0x98, 0x71 } } + [Ppis] ## Include/Ppi/AtaController.h gPeiAtaControllerPpiGuid =3D { 0xa45e60d1, 0xc719, 0x44aa, { 0xb0,= 0x7a, 0xaa, 0x77, 0x7f, 0x85, 0x90, 0x6d }} diff --git a/MdeModulePkg/Core/Pei/PeiMain.inf b/MdeModulePkg/Core/Pei/PeiM= ain.inf index 5b36d516b3fa..0cf357371a16 100644 --- a/MdeModulePkg/Core/Pei/PeiMain.inf +++ b/MdeModulePkg/Core/Pei/PeiMain.inf @@ -77,6 +77,7 @@ [Guids] ## CONSUMES ## GUID # Used to compare with FV's file system GUID = and get the FV's file system format gEfiFirmwareFileSystem3Guid gStatusCodeCallbackGuid + gEdkiiMigratedFvInfoGuid ## SOMETIMES_PRODUCES = ## HOB =20 [Ppis] gEfiPeiStatusCodePpiGuid ## SOMETIMES_CONSUMES # Pe= iReportStatusService is not ready if this PPI doesn't exist diff --git a/MdeModulePkg/Core/Pei/PeiMain.h b/MdeModulePkg/Core/Pei/PeiMai= n.h index b0101dba5e30..cbf74d5b9d9a 100644 --- a/MdeModulePkg/Core/Pei/PeiMain.h +++ b/MdeModulePkg/Core/Pei/PeiMain.h @@ -44,6 +44,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include #include #include +#include =20 /// /// It is an FFS type extension used for PeiFindFileEx. It indicates curre= nt diff --git a/MdeModulePkg/Include/Guid/MigratedFvInfo.h b/MdeModulePkg/Incl= ude/Guid/MigratedFvInfo.h new file mode 100644 index 000000000000..061c17ed0e48 --- /dev/null +++ b/MdeModulePkg/Include/Guid/MigratedFvInfo.h @@ -0,0 +1,22 @@ +/** @file + Migrated FV information + +Copyright (c) 2020, Intel Corporation. All rights reserved.
+SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#ifndef __EDKII_MIGRATED_FV_INFO_GUID_H__ +#define __EDKII_MIGRATED_FV_INFO_GUID_H__ + +typedef struct { + UINT32 FvOrgBase; // original FV address + UINT32 FvNewBase; // new FV address + UINT32 FvDataBase; // original FV data + UINT32 FvLength; // Fv Length +} EDKII_MIGRATED_FV_INFO; + +extern EFI_GUID gEdkiiMigratedFvInfoGuid; + +#endif // #ifndef __EDKII_MIGRATED_FV_INFO_GUID_H__ + diff --git a/MdeModulePkg/Core/Pei/Dispatcher/Dispatcher.c b/MdeModulePkg/C= ore/Pei/Dispatcher/Dispatcher.c index ef88b3423376..f654cea15c59 100644 --- a/MdeModulePkg/Core/Pei/Dispatcher/Dispatcher.c +++ b/MdeModulePkg/Core/Pei/Dispatcher/Dispatcher.c @@ -1223,10 +1223,12 @@ EvacuateTempRam ( EFI_FIRMWARE_VOLUME_HEADER *FvHeader; EFI_FIRMWARE_VOLUME_HEADER *ChildFvHeader; EFI_FIRMWARE_VOLUME_HEADER *MigratedFvHeader; + EFI_FIRMWARE_VOLUME_HEADER *RawDataFvHeader; EFI_FIRMWARE_VOLUME_HEADER *MigratedChildFvHeader; =20 PEI_CORE_FV_HANDLE PeiCoreFvHandle; EFI_PEI_CORE_FV_LOCATION_PPI *PeiCoreFvLocationPpi; + EDKII_MIGRATED_FV_INFO MigratedFvInfo; =20 ASSERT (Private->PeiMemoryInstalled); =20 @@ -1263,6 +1265,9 @@ EvacuateTempRam ( (((EFI_PHYSICAL_ADDRESS)(UINTN) FvHeader + (FvHeader->FvLength - 1= )) < Private->FreePhysicalMemoryTop) ) ) { + // + // Allocate page to save the rebased PEIMs, the PEIMs will get contr= ol later + // Status =3D PeiServicesAllocatePages ( EfiBootServicesCode, EFI_SIZE_TO_PAGES ((UINTN) FvHeader->FvLength), @@ -1270,6 +1275,17 @@ EvacuateTempRam ( ); ASSERT_EFI_ERROR (Status); =20 + // + // Allocate pool to save the raw PEIMs, it used to keep consistent c= ontext across + // multiple boot and PCR0 will keep same no matter if allocate rando= m page address. + // + Status =3D PeiServicesAllocatePages ( + EfiBootServicesCode, + EFI_SIZE_TO_PAGES ((UINTN) FvHeader->FvLength), + (EFI_PHYSICAL_ADDRESS *) &RawDataFvHeader + ); + ASSERT_EFI_ERROR (Status); + DEBUG (( DEBUG_VERBOSE, " Migrating FV[%d] from 0x%08X to 0x%08X\n", @@ -1278,7 +1294,19 @@ EvacuateTempRam ( (UINTN) MigratedFvHeader )); =20 + // + // Copy the context to the rebased pages and raw pages, and create h= ob to save the + // information. the MigratedFvInfo HOB will never produce when + // PcdMigrateTemporaryRamFirmwareVolumes is FALSE, because the PCD c= ontrol the + // feature. + // CopyMem (MigratedFvHeader, FvHeader, (UINTN) FvHeader->FvLength); + CopyMem (RawDataFvHeader, MigratedFvHeader, (UINTN) FvHeader->FvLeng= th); + MigratedFvInfo.FvOrgBase =3D (UINT32) (UINTN) FvHeader; + MigratedFvInfo.FvNewBase =3D (UINT32) (UINTN) MigratedFvHeader; + MigratedFvInfo.FvDataBase =3D (UINT32) (UINTN) RawDataFvHeader; + MigratedFvInfo.FvLength =3D (UINT32) (UINTN) FvHeader->FvLength; + BuildGuidDataHob (&gEdkiiMigratedFvInfoGuid, &MigratedFvInfo, sizeof= (MigratedFvInfo)); =20 // // Migrate any children for this FV now --=20 2.25.1.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#62223): https://edk2.groups.io/g/devel/message/62223 Mute This Topic: https://groups.io/mt/75372253/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-