File ovmf-bsc1188371-SecurityPkg-Tcg2Pei-Use-Migrate... of Package ovmf.27284

Overview Repositories Revisions Requests Users Attributes Meta

File ovmf-bsc1188371-SecurityPkg-Tcg2Pei-Use-Migrated-FV-Info-Hob-for-cal.patch of Package ovmf.27284

From 012809cdca4b876e675cbd181fee213133858a5e Mon Sep 17 00:00:00 2001
From: Guomin Jiang <guomin.jiang@intel.com>
Date: Mon, 29 Jun 2020 14:50:21 +0800
Subject: [PATCH 6/9] SecurityPkg/Tcg2Pei: Use Migrated FV Info Hob for
 calculating hash (CVE-2019-11098)

REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1614

When we allocate pool to save rebased the PEIMs, the address will change
randomly, therefore the hash will change and result PCR0 change as well.
To avoid this, we save the raw PEIMs and use it to calculate hash.
The Tcg2Pei calculate the hash and it use the Migrated FV Info.

Joey Lee:
Modified for do not backport "0286fe8176 SecurityPkg/Tcg2Pei: Add TCG PFP 105 support."
because edk2-stable201911 doesn't support TCG PFP 105.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Qi Zhang <qi1.zhang@intel.com>
Cc: Rahul Kumar <rahul1.kumar@intel.com>
Signed-off-by: Guomin Jiang <guomin.jiang@intel.com>
Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
Reviewed-by: Qi Zhang <qi1.zhang@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>
---
 SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c   | 31 ++++++++++++++++++++++++++---
 SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf |  1 +
 2 files changed, 29 insertions(+), 3 deletions(-)

Index: edk2-edk2-stable201911/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c
===================================================================
--- edk2-edk2-stable201911.orig/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c
+++ edk2-edk2-stable201911/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c
@@ -21,6 +21,7 @@ SPDX-License-Identifier: BSD-2-Clause-Pa
 #include <Guid/TcgEventHob.h>
 #include <Guid/MeasuredFvHob.h>
 #include <Guid/TpmInstance.h>
+#include <Guid/MigratedFvInfo.h>
 
 #include <Library/DebugLib.h>
 #include <Library/BaseMemoryLib.h>
@@ -478,6 +479,10 @@ MeasureFvImage (
   EDKII_PEI_FIRMWARE_VOLUME_INFO_PREHASHED_FV_PPI       *PrehashedFvPpi;
   HASH_INFO                                             *PreHashInfo;
   UINT32                                                HashAlgoMask;
+  EFI_PHYSICAL_ADDRESS                                  FvOrgBase;
+  EFI_PHYSICAL_ADDRESS                                  FvDataBase;
+  EFI_PEI_HOB_POINTERS                                  Hob;
+  EDKII_MIGRATED_FV_INFO                                *MigratedFvInfo;
 
   //
   // Check Excluded FV list
@@ -564,9 +569,29 @@ MeasureFvImage (
   } while (!EFI_ERROR(Status));
 
   //
+  // Search the matched migration FV info
+  //
+  FvOrgBase  = FvBase;
+  FvDataBase = FvBase;
+  Hob.Raw  = GetFirstGuidHob (&gEdkiiMigratedFvInfoGuid);
+  while (Hob.Raw != NULL) {
+    MigratedFvInfo = GET_GUID_HOB_DATA (Hob);
+    if ((MigratedFvInfo->FvNewBase == (UINT32) FvBase) && (MigratedFvInfo->FvLength == (UINT32) FvLength)) {
+      //
+      // Found the migrated FV info
+      //
+      FvOrgBase  = (EFI_PHYSICAL_ADDRESS) (UINTN) MigratedFvInfo->FvOrgBase;
+      FvDataBase = (EFI_PHYSICAL_ADDRESS) (UINTN) MigratedFvInfo->FvDataBase;
+      break;
+    }
+    Hob.Raw = GET_NEXT_HOB (Hob);
+    Hob.Raw = GetNextGuidHob (&gEdkiiMigratedFvInfoGuid, Hob.Raw);
+  }
+
+  //
   // Init the log event for FV measurement
   //
-  FvBlob.BlobBase       = FvBase;
+  FvBlob.BlobBase       = FvOrgBase;
   FvBlob.BlobLength     = FvLength;
   TcgEventHdr.PCRIndex  = 0;
   TcgEventHdr.EventType = EV_EFI_PLATFORM_FIRMWARE_BLOB;
@@ -599,7 +624,7 @@ MeasureFvImage (
     //
     Status = HashLogExtendEvent (
                0,
-               (UINT8*) (UINTN) FvBlob.BlobBase,
+               (UINT8*) (UINTN) FvDataBase, // HashData
                (UINTN) FvBlob.BlobLength,
                &TcgEventHdr,
                (UINT8*) &FvBlob
Index: edk2-edk2-stable201911/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
===================================================================
--- edk2-edk2-stable201911.orig/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
+++ edk2-edk2-stable201911/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
@@ -62,6 +62,7 @@
   gTcgEvent2EntryHobGuid                                               ## PRODUCES               ## HOB
   gEfiTpmDeviceInstanceNoneGuid                                        ## SOMETIMES_PRODUCES     ## GUID       # TPM device identifier
   gEfiTpmDeviceInstanceTpm12Guid                                       ## SOMETIMES_PRODUCES     ## GUID       # TPM device identifier
+  gEdkiiMigratedFvInfoGuid                                             ## SOMETIMES_CONSUMES     ## HOB
 
 [Ppis]
   gEfiPeiFirmwareVolumeInfoPpiGuid                                     ## SOMETIMES_CONSUMES     ## NOTIFY

Places

File ovmf-bsc1188371-SecurityPkg-Tcg2Pei-Use-Migrated-FV-Info-Hob-for-cal.patch of Package ovmf.27284

Places