From nobody Sun Feb 8 17:21:08 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) client-ip=66.175.222.12; envelope-from=bounce+27952+63238+1787277+3901457@groups.io; helo=web01.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) smtp.mailfrom=bounce+27952+63238+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1595584502; cv=none; d=zohomail.com; s=zohoarc; b=ZlMeSs47a7Vg8s8wvGdZtM7b9E7MTqz2um6lUcnEqv/w+/Xwu4agtBnymSEqFF1zaqvCaWuAmfhJPoZe4smYZcxL1VgrQl6buqn4kEYTNOEW9xTuNHdJp5los6nj8/gXsvv+masSFYwzjeiUJRq+x6LOk+4g/mCYn8MrIMx8eBg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1595584502; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Id:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=pReIuj55TRi+4b1wCJzpUnJgNR1gh54S1hJHy0ezKI8=; b=LWcSdl/4EWNQHDNx+NdKVeOHS3Z+UmmutM69byusHmicRbXlhNXXlNncTULCD+22qY+ksUfTYvbNgijz3kQhLIs5g/a3D4tVtFzPQBoeuQGkDag5uCWdcnkn8qMCEvoUl9rfGRe42SeFvncMdDHzpX+5ZmMcRML8P3mHcqMX2pg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) smtp.mailfrom=bounce+27952+63238+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) header.from= Received: from web01.groups.io (web01.groups.io [66.175.222.12]) by mx.zohomail.com with SMTPS id 159558450217226.039301905736806; Fri, 24 Jul 2020 02:55:02 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id gVGcYY1788612x4V62wkFLQg; Fri, 24 Jul 2020 02:55:01 -0700 X-Received: from mga09.intel.com (mga09.intel.com []) by mx.groups.io with SMTP id smtpd.web10.2987.1595584489166956048 for ; Fri, 24 Jul 2020 02:55:01 -0700 IronPort-SDR: F/3OeoRlyME3/+MkkQdfGB5aZYKHEfB/lGIizUZjIl1KwHFXK+Bvb5hshegJxJ573AKoSK1cD3 +JHhRYLFfC4w== X-IronPort-AV: E=McAfee;i="6000,8403,9691"; a="151973973" X-IronPort-AV: E=Sophos;i="5.75,390,1589266800"; d="scan'208";a="151973973" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-Received: from orsmga008.jf.intel.com ([10.7.209.65]) by orsmga102.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Jul 2020 02:55:01 -0700 IronPort-SDR: 5bxjALEwmNqWExnXlc+TPwnO2i2N0g5B14k7m85vjvNzn159tj8Sd53bHsninTdr6MDH72u1e8 Kr6R/6Y0b7HA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.75,390,1589266800"; d="scan'208";a="319266309" X-Received: from guominji-mobl.ccr.corp.intel.com ([10.238.13.140]) by orsmga008.jf.intel.com with ESMTP; 24 Jul 2020 02:54:59 -0700 From: "Guomin Jiang" To: devel@edk2.groups.io Cc: Jiewen Yao , Jian J Wang , Chao Zhang , Qi Zhang , Rahul Kumar Subject: [edk2-devel] [PATCH v8 6/9] SecurityPkg/Tcg2Pei: Use Migrated FV Info Hob for calculating hash (CVE-2019-11098) Date: Fri, 24 Jul 2020 17:54:43 +0800 Message-Id: <20200724095446.598-7-guomin.jiang@intel.com> In-Reply-To: <20200724095446.598-1-guomin.jiang@intel.com> References: <20200724095446.598-1-guomin.jiang@intel.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,guomin.jiang@intel.com X-Gm-Message-State: CxTNZV7TrnS637KmZ1SrGlIHx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1595584501; bh=tqR8gQ1fesm/KYpI9D8Ty+Sm3hFwneF7J8u7blrFJhQ=; h=Cc:Date:From:Reply-To:Subject:To; b=TXnQt/QKddtHI2MItLaaFqz2W5PdwcYWMX0hoXNkCooR3UOI6NpQWvGHwT7pVwzZm26 abIMgYTLBZD/S/1KQfMweX8cVGi6e2wTz2vYGtIsnfQNzWRFHrWecaSGxMwaiJD+Ccbov 4TYR6uPOraaFrBM9J1l+4GLVgde5E/GyPL4= X-ZohoMail-DKIM: pass (identity @groups.io) Content-Type: text/plain; charset="utf-8" REF:https://bugzilla.tianocore.org/show_bug.cgi?id=3D1614 When we allocate pool to save rebased the PEIMs, the address will change randomly, therefore the hash will change and result PCR0 change as well. To avoid this, we save the raw PEIMs and use it to calculate hash. The Tcg2Pei calculate the hash and it use the Migrated FV Info. Cc: Jiewen Yao Cc: Jian J Wang Cc: Chao Zhang Cc: Qi Zhang Cc: Rahul Kumar Signed-off-by: Guomin Jiang Reviewed-by: Jian J Wang Reviewed-by: Qi Zhang --- SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf | 1 + SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c | 31 ++++++++++++++++++++++++++--- 2 files changed, 29 insertions(+), 3 deletions(-) diff --git a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf b/SecurityPkg/Tcg/Tcg2Pei/= Tcg2Pei.inf index f64b29f1ae4c..06c26a2904b8 100644 --- a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf +++ b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf @@ -63,6 +63,7 @@ [Guids] gTcgEvent2EntryHobGuid ## = PRODUCES ## HOB gEfiTpmDeviceInstanceNoneGuid ## = SOMETIMES_PRODUCES ## GUID # TPM device identifier gEfiTpmDeviceInstanceTpm12Guid ## = SOMETIMES_PRODUCES ## GUID # TPM device identifier + gEdkiiMigratedFvInfoGuid ## = SOMETIMES_CONSUMES ## HOB =20 [Ppis] gEfiPeiFirmwareVolumeInfoPpiGuid ## = SOMETIMES_CONSUMES ## NOTIFY diff --git a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c b/SecurityPkg/Tcg/Tcg2Pei/Tc= g2Pei.c index 71695df3d865..246968bb7f8d 100644 --- a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c +++ b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c @@ -22,6 +22,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include #include #include +#include =20 #include #include @@ -593,6 +594,10 @@ MeasureFvImage ( EDKII_PEI_FIRMWARE_VOLUME_INFO_PREHASHED_FV_PPI *PrehashedFvPpi; HASH_INFO *PreHashInfo; UINT32 HashAlgoMask; + EFI_PHYSICAL_ADDRESS FvOrgBase; + EFI_PHYSICAL_ADDRESS FvDataBase; + EFI_PEI_HOB_POINTERS Hob; + EDKII_MIGRATED_FV_INFO *MigratedFvInfo; =20 // // Check Excluded FV list @@ -678,6 +683,26 @@ MeasureFvImage ( Instance++; } while (!EFI_ERROR(Status)); =20 + // + // Search the matched migration FV info + // + FvOrgBase =3D FvBase; + FvDataBase =3D FvBase; + Hob.Raw =3D GetFirstGuidHob (&gEdkiiMigratedFvInfoGuid); + while (Hob.Raw !=3D NULL) { + MigratedFvInfo =3D GET_GUID_HOB_DATA (Hob); + if ((MigratedFvInfo->FvNewBase =3D=3D (UINT32) FvBase) && (MigratedFvI= nfo->FvLength =3D=3D (UINT32) FvLength)) { + // + // Found the migrated FV info + // + FvOrgBase =3D (EFI_PHYSICAL_ADDRESS) (UINTN) MigratedFvInfo->FvOrgB= ase; + FvDataBase =3D (EFI_PHYSICAL_ADDRESS) (UINTN) MigratedFvInfo->FvData= Base; + break; + } + Hob.Raw =3D GET_NEXT_HOB (Hob); + Hob.Raw =3D GetNextGuidHob (&gEdkiiMigratedFvInfoGuid, Hob.Raw); + } + // // Init the log event for FV measurement // @@ -688,14 +713,14 @@ MeasureFvImage ( if (FvName !=3D NULL) { AsciiSPrint ((CHAR8 *)FvBlob2.BlobDescription, sizeof(FvBlob2.BlobDe= scription), "Fv(%g)", FvName); } - FvBlob2.BlobBase =3D FvBase; + FvBlob2.BlobBase =3D FvOrgBase; FvBlob2.BlobLength =3D FvLength; TcgEventHdr.PCRIndex =3D 0; TcgEventHdr.EventType =3D EV_EFI_PLATFORM_FIRMWARE_BLOB2; TcgEventHdr.EventSize =3D sizeof (FvBlob2); EventData =3D &FvBlob2; } else { - FvBlob.BlobBase =3D FvBase; + FvBlob.BlobBase =3D FvOrgBase; FvBlob.BlobLength =3D FvLength; TcgEventHdr.PCRIndex =3D 0; TcgEventHdr.EventType =3D EV_EFI_PLATFORM_FIRMWARE_BLOB; @@ -725,7 +750,7 @@ MeasureFvImage ( Status =3D HashLogExtendEvent ( &mEdkiiTcgPpi, 0, - (UINT8*) (UINTN) FvBase, // HashData + (UINT8*) (UINTN) FvDataBase, // HashData (UINTN) FvLength, // HashDataLen &TcgEventHdr, // EventHdr EventData // EventData --=20 2.25.1.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#63238): https://edk2.groups.io/g/devel/message/63238 Mute This Topic: https://groups.io/mt/75763383/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-