From nobody Mon Feb 9 08:27:54 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) client-ip=66.175.222.12; envelope-from=bounce+27952+62833+1787277+3901457@groups.io; helo=web01.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) smtp.mailfrom=bounce+27952+62833+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1595244648; cv=none; d=zohomail.com; s=zohoarc; b=Y9jjB5weccWcztDZnTmZoed8pl/idTwRh+UWjF3E9v4ysfgtSYM9Ec438JTUnqTZEvNDL5QiYxfFE8FW5OUfYfRxWzFa9UKlR3GZLtuQr0DGRx/x0dHfl5BCt3eDzKMr0VXmZ5yfweCpq7tFniz5fmBwXTd/335lMcKEkgmJM0w= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1595244648; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Id:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=tTyO5XuCBEL8Gt3QAUPiYKZ+oCIQF+wXev0d5gsvQnY=; b=Pe1gAqDNMlp7xaGD5JIursJWFQ4fcYFNhWPeRHEAFzpMZYzK1HEhPmun+5SCMmzGKogvwfR7F0h/J7BGOpSX0ZMCO5G8fy055/5gTq0xN3iKl1BXQzIwFoKLzLByxwBMbkonmF82cNQILz/VpjZroccbFAVo/GHyCnaNPhxwBm0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) smtp.mailfrom=bounce+27952+62833+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) header.from= Received: from web01.groups.io (web01.groups.io [66.175.222.12]) by mx.zohomail.com with SMTPS id 1595244648635582.2999633155914; Mon, 20 Jul 2020 04:30:48 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id i0fiYY1788612xUSPWsWnS2v; Mon, 20 Jul 2020 04:30:48 -0700 X-Received: from mga18.intel.com (mga18.intel.com []) by mx.groups.io with SMTP id smtpd.web12.35600.1595244629521419095 for ; Mon, 20 Jul 2020 04:30:47 -0700 IronPort-SDR: U55i4HIHLlWJz9imWS6T7onRve0J6GK+wCxs8MIRqjtukHXbKOvxd80V2hIIAy77qSNNoiBvH2 NjQvR/YeYgCw== X-IronPort-AV: E=McAfee;i="6000,8403,9687"; a="137373225" X-IronPort-AV: E=Sophos;i="5.75,374,1589266800"; d="scan'208";a="137373225" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by orsmga106.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 20 Jul 2020 04:30:47 -0700 IronPort-SDR: WdWQNTbjrnk4Esdw53muGkeAoGrWY2SPN6YZL6mNQwBTqNSs+TZ6Bvbsq8Bejfihifh/AHn7SP D+N7E+ue17Fg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.75,374,1589266800"; d="scan'208";a="271411304" X-Received: from guominji-mobl.ccr.corp.intel.com ([10.238.13.140]) by fmsmga008.fm.intel.com with ESMTP; 20 Jul 2020 04:30:45 -0700 From: "Guomin Jiang" To: devel@edk2.groups.io Cc: Jiewen Yao , Jian J Wang , Chao Zhang , Qi Zhang , Rahul Kumar Subject: [edk2-devel] [PATCH v6 09/10] SecurityPkg/TcgPei: Use Migrated FV Info Hob for calculating hash (CVE-2019-11098) Date: Mon, 20 Jul 2020 19:30:21 +0800 Message-Id: <20200720113022.675-10-guomin.jiang@intel.com> In-Reply-To: <20200720113022.675-1-guomin.jiang@intel.com> References: <20200720113022.675-1-guomin.jiang@intel.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,guomin.jiang@intel.com X-Gm-Message-State: rbze0fjJZUzqd42unbqM7Q26x1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1595244648; bh=+gyIQcvpyvU/luUm0A3yKD32E/03JoQERZBVdYmdYVA=; h=Cc:Date:From:Reply-To:Subject:To; b=WPlJxcxpjO90a7J1HQrOuDuMemOknqdnvbRrcNB7MlanygCpcXBJ//IBUKbrPXpcuKp Qo6rdtPYTBgM1lqXMSL35Q884nrZIRx589J6t5Eoo5nFQggv0e8/xBRqnm3hrMf+yunDB WOYiv5NhzfbA/2qsdmiDkuAB8t1g7aLdHqg= X-ZohoMail-DKIM: pass (identity @groups.io) Content-Type: text/plain; charset="utf-8" REF:https://bugzilla.tianocore.org/show_bug.cgi?id=3D1614 When we allocate pool to save rebased the PEIMs, the address will change randomly, therefore the hash will change and result PCR0 change as well. To avoid this, we save the raw PEIMs and use it to calculate hash. The TcgPei calculate the hash and it use the Migrated FV Info. Cc: Jiewen Yao Cc: Jian J Wang Cc: Chao Zhang Cc: Qi Zhang Cc: Rahul Kumar Signed-off-by: Guomin Jiang Reviewed-by: Jian J Wang Reviewed-by: Zhang, Qi1 --- SecurityPkg/Tcg/TcgPei/TcgPei.inf | 1 + SecurityPkg/Tcg/TcgPei/TcgPei.c | 29 +++++++++++++++++++++++++++-- 2 files changed, 28 insertions(+), 2 deletions(-) diff --git a/SecurityPkg/Tcg/TcgPei/TcgPei.inf b/SecurityPkg/Tcg/TcgPei/Tcg= Pei.inf index c0bff6e85e9d..6d1951f8ed65 100644 --- a/SecurityPkg/Tcg/TcgPei/TcgPei.inf +++ b/SecurityPkg/Tcg/TcgPei/TcgPei.inf @@ -58,6 +58,7 @@ [Guids] gTpmErrorHobGuid ## S= OMETIMES_PRODUCES ## HOB gMeasuredFvHobGuid ## P= RODUCES ## HOB gEfiTpmDeviceInstanceTpm12Guid ## P= RODUCES ## GUID # TPM device identifier + gEdkiiMigratedFvInfoGuid ## S= OMETIMES_CONSUMES ## HOB =20 [Ppis] gPeiLockPhysicalPresencePpiGuid ## S= OMETIMES_CONSUMES ## NOTIFY diff --git a/SecurityPkg/Tcg/TcgPei/TcgPei.c b/SecurityPkg/Tcg/TcgPei/TcgPe= i.c index a9a808c9ecf3..9701bfe8715b 100644 --- a/SecurityPkg/Tcg/TcgPei/TcgPei.c +++ b/SecurityPkg/Tcg/TcgPei/TcgPei.c @@ -21,6 +21,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include #include #include +#include =20 #include #include @@ -378,6 +379,10 @@ MeasureFvImage ( EFI_STATUS Status; EFI_PLATFORM_FIRMWARE_BLOB FvBlob; TCG_PCR_EVENT_HDR TcgEventHdr; + EFI_PHYSICAL_ADDRESS FvOrgBase; + EFI_PHYSICAL_ADDRESS FvDataBase; + EFI_PEI_HOB_POINTERS Hob; + EDKII_MIGRATED_FV_INFO *MigratedFvInfo; =20 // // Check if it is in Excluded FV list @@ -401,10 +406,30 @@ MeasureFvImage ( } } =20 + // + // Search the matched migration FV info + // + FvOrgBase =3D FvBase; + FvDataBase =3D FvBase; + Hob.Raw =3D GetFirstGuidHob (&gEdkiiMigratedFvInfoGuid); + while (Hob.Raw !=3D NULL) { + MigratedFvInfo =3D GET_GUID_HOB_DATA (Hob); + if ((MigratedFvInfo->FvNewBase =3D=3D (UINT32) FvBase) && (MigratedFvI= nfo->FvLength =3D=3D (UINT32) FvLength)) { + // + // Found the migrated FV info + // + FvOrgBase =3D (EFI_PHYSICAL_ADDRESS) (UINTN) MigratedFvInfo->FvOrgB= ase; + FvDataBase =3D (EFI_PHYSICAL_ADDRESS) (UINTN) MigratedFvInfo->FvData= Base; + break; + } + Hob.Raw =3D GET_NEXT_HOB (Hob); + Hob.Raw =3D GetNextGuidHob (&gEdkiiMigratedFvInfoGuid, Hob.Raw); + } + // // Measure and record the FV to the TPM // - FvBlob.BlobBase =3D FvBase; + FvBlob.BlobBase =3D FvOrgBase; FvBlob.BlobLength =3D FvLength; =20 DEBUG ((DEBUG_INFO, "The FV which is measured by TcgPei starts at: 0x%x\= n", FvBlob.BlobBase)); @@ -416,7 +441,7 @@ MeasureFvImage ( =20 Status =3D HashLogExtendEvent ( (EFI_PEI_SERVICES **) GetPeiServicesTablePointer(), - (UINT8*) (UINTN) FvBlob.BlobBase, + (UINT8*) (UINTN) FvDataBase, (UINTN) FvBlob.BlobLength, &TcgEventHdr, (UINT8*) &FvBlob --=20 2.25.1.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#62833): https://edk2.groups.io/g/devel/message/62833 Mute This Topic: https://groups.io/mt/75679710/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-