MdeModulePkg/Core: Create Migrated FV Info Hob for calculating hash (CVE-2019-11098)

REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1614

When we allocate pool to save the rebased PEIMs, the address will change
randomly, therefore the hash will change and result PCR0 change as well.
To avoid this, we save the raw PEIMs and use it to calculate hash.

The MigratedFvInfo HOB will never produce when
PcdMigrateTemporaryRamFirmwareVolumes is FALSE, because the PCD control
the total feature.

Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Hao A Wu <hao.a.wu@intel.com>
Cc: Dandan Bi <dandan.bi@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Debkumar De <debkumar.de@intel.com>
Cc: Harry Han <harry.han@intel.com>
Cc: Catharine West <catharine.west@intel.com>
Signed-off-by: Guomin Jiang <guomin.jiang@intel.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>

diff --git a/MdeModulePkg/Core/Pei/Dispatcher/Dispatcher.c b/MdeModulePkg/Core/Pei/Dispatcher/Dispatcher.c
index 5bc0f8674d601cc79126000db70431c5f6be5e9c..b9a279ec73a2b1338dbdf0cfb35c45c4b3d3f255 100644 (file)
--- a/MdeModulePkg/Core/Pei/Dispatcher/Dispatcher.c
+++ b/MdeModulePkg/Core/Pei/Dispatcher/Dispatcher.c
@@ -1234,10 +1234,12 @@ EvacuateTempRam (
   EFI_FIRMWARE_VOLUME_HEADER    *FvHeader;\r
   EFI_FIRMWARE_VOLUME_HEADER    *ChildFvHeader;\r
   EFI_FIRMWARE_VOLUME_HEADER    *MigratedFvHeader;\r
+  EFI_FIRMWARE_VOLUME_HEADER    *RawDataFvHeader;\r
   EFI_FIRMWARE_VOLUME_HEADER    *MigratedChildFvHeader;\r
 \r
   PEI_CORE_FV_HANDLE            PeiCoreFvHandle;\r
   EFI_PEI_CORE_FV_LOCATION_PPI  *PeiCoreFvLocationPpi;\r
+  EDKII_MIGRATED_FV_INFO        MigratedFvInfo;\r
 \r
   ASSERT (Private->PeiMemoryInstalled);\r
 \r
@@ -1274,6 +1276,9 @@ EvacuateTempRam (
         (((EFI_PHYSICAL_ADDRESS)(UINTN) FvHeader + (FvHeader->FvLength - 1)) < Private->FreePhysicalMemoryTop)\r
         )\r
       ) {\r
+      //\r
+      // Allocate page to save the rebased PEIMs, the PEIMs will get dispatched later.\r
+      //\r
       Status =  PeiServicesAllocatePages (\r
                   EfiBootServicesCode,\r
                   EFI_SIZE_TO_PAGES ((UINTN) FvHeader->FvLength),\r
@@ -1281,6 +1286,17 @@ EvacuateTempRam (
                   );\r
       ASSERT_EFI_ERROR (Status);\r
 \r
+      //\r
+      // Allocate pool to save the raw PEIMs, which is used to keep consistent context across\r
+      // multiple boot and PCR0 will keep the same no matter if the address of allocated page is changed.\r
+      //\r
+      Status =  PeiServicesAllocatePages (\r
+                  EfiBootServicesCode,\r
+                  EFI_SIZE_TO_PAGES ((UINTN) FvHeader->FvLength),\r
+                  (EFI_PHYSICAL_ADDRESS *) &RawDataFvHeader\r
+                  );\r
+      ASSERT_EFI_ERROR (Status);\r
+\r
       DEBUG ((\r
         DEBUG_VERBOSE,\r
         "  Migrating FV[%d] from 0x%08X to 0x%08X\n",\r
@@ -1289,7 +1305,19 @@ EvacuateTempRam (
         (UINTN) MigratedFvHeader\r
         ));\r
 \r
+      //\r
+      // Copy the context to the rebased pages and raw pages, and create hob to save the\r
+      // information. The MigratedFvInfo HOB will never be produced when\r
+      // PcdMigrateTemporaryRamFirmwareVolumes is FALSE, because the PCD control the\r
+      // feature.\r
+      //\r
       CopyMem (MigratedFvHeader, FvHeader, (UINTN) FvHeader->FvLength);\r
+      CopyMem (RawDataFvHeader, MigratedFvHeader, (UINTN) FvHeader->FvLength);\r
+      MigratedFvInfo.FvOrgBase  = (UINT32) (UINTN) FvHeader;\r
+      MigratedFvInfo.FvNewBase  = (UINT32) (UINTN) MigratedFvHeader;\r
+      MigratedFvInfo.FvDataBase = (UINT32) (UINTN) RawDataFvHeader;\r
+      MigratedFvInfo.FvLength   = (UINT32) (UINTN) FvHeader->FvLength;\r
+      BuildGuidDataHob (&gEdkiiMigratedFvInfoGuid, &MigratedFvInfo, sizeof (MigratedFvInfo));\r
 \r
       //\r
       // Migrate any children for this FV now\r

diff --git a/MdeModulePkg/Core/Pei/PeiMain.h b/MdeModulePkg/Core/Pei/PeiMain.h
index 6d95a5d32c784b1759263cc13bbff3d9e2366c0b..c27e8fc33bc64321b980a5d508e3075ce0da0070 100644 (file)
--- a/MdeModulePkg/Core/Pei/PeiMain.h
+++ b/MdeModulePkg/Core/Pei/PeiMain.h
@@ -44,6 +44,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #include <Guid/FirmwareFileSystem2.h>\r
 #include <Guid/FirmwareFileSystem3.h>\r
 #include <Guid/AprioriFileName.h>\r
+#include <Guid/MigratedFvInfo.h>\r
 \r
 ///\r
 /// It is an FFS type extension used for PeiFindFileEx. It indicates current\r

diff --git a/MdeModulePkg/Core/Pei/PeiMain.inf b/MdeModulePkg/Core/Pei/PeiMain.inf
index 5b36d516b3fae921f406a76f86efafc47ffe6303..0cf357371a16d872188c5192a08772000e2d3190 100644 (file)
--- a/MdeModulePkg/Core/Pei/PeiMain.inf
+++ b/MdeModulePkg/Core/Pei/PeiMain.inf
@@ -77,6 +77,7 @@
   ## CONSUMES   ## GUID      # Used to compare with FV's file system GUID and get the FV's file system format\r
   gEfiFirmwareFileSystem3Guid\r
   gStatusCodeCallbackGuid\r
+  gEdkiiMigratedFvInfoGuid                      ## SOMETIMES_PRODUCES     ## HOB\r
 \r
 [Ppis]\r
   gEfiPeiStatusCodePpiGuid                      ## SOMETIMES_CONSUMES # PeiReportStatusService is not ready if this PPI doesn't exist\r

diff --git a/MdeModulePkg/Include/Guid/MigratedFvInfo.h b/MdeModulePkg/Include/Guid/MigratedFvInfo.h
new file mode 100644 (file)
index 0000000..061c17e
--- /dev/null
+++ b/MdeModulePkg/Include/Guid/MigratedFvInfo.h
@@ -0,0 +1,22 @@
+/** @file\r
+  Migrated FV information\r
+\r
+Copyright (c) 2020, Intel Corporation. All rights reserved.<BR>\r
+SPDX-License-Identifier: BSD-2-Clause-Patent\r
+\r
+**/\r
+\r
+#ifndef __EDKII_MIGRATED_FV_INFO_GUID_H__\r
+#define __EDKII_MIGRATED_FV_INFO_GUID_H__\r
+\r
+typedef struct {\r
+  UINT32           FvOrgBase;  // original FV address\r
+  UINT32           FvNewBase;  // new FV address\r
+  UINT32           FvDataBase; // original FV data\r
+  UINT32           FvLength;   // Fv Length\r
+} EDKII_MIGRATED_FV_INFO;\r
+\r
+extern EFI_GUID gEdkiiMigratedFvInfoGuid;\r
+\r
+#endif // #ifndef __EDKII_MIGRATED_FV_INFO_GUID_H__\r
+\r

diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
index 45874e9c8236a4489593db61056f9b11202ec838..d7572eedd18c7da9247758e226f0c3cf46d3d1d0 100644 (file)
--- a/MdeModulePkg/MdeModulePkg.dec
+++ b/MdeModulePkg/MdeModulePkg.dec
@@ -389,6 +389,9 @@
   ## GUID indicates the capsule is to store Capsule On Disk file names.\r
   gEdkiiCapsuleOnDiskNameGuid = { 0x98c80a4f, 0xe16b, 0x4d11, { 0x93, 0x9a, 0xab, 0xe5, 0x61, 0x26, 0x3, 0x30 } }\r
 \r
+  ## Include/Guid/MigratedFvInfo.h\r
+  gEdkiiMigratedFvInfoGuid = { 0xc1ab12f7, 0x74aa, 0x408d, { 0xa2, 0xf4, 0xc6, 0xce, 0xfd, 0x17, 0x98, 0x71 } }\r
+\r
 [Ppis]\r
   ## Include/Ppi/AtaController.h\r
   gPeiAtaControllerPpiGuid       = { 0xa45e60d1, 0xc719, 0x44aa, { 0xb0, 0x7a, 0xaa, 0x77, 0x7f, 0x85, 0x90, 0x6d }}\r