On 2026-11-01T07:01:22+11:00, Ana Bobillo <[email protected]> wrote: > efi_loader: Measure the GPT the partition driver uses > > tcg2_measure_gpt_data() reads the primary GPT and measures it into > PCR 5 without checking it, while the partition driver uses the backup > GPT when the primary header or entries are not valid. So PCR 5 may hold > a GPT the partitions were not found in: a change to an unused primary > entry, which is not measured, leaves PCR 5 as it was while the > partitions come from the backup GPT. Nor are the sizes in the header > checked, so an entry array size that wraps in 32 bits makes the walks > read past the end of the entry buffer. > > Measure the GPT the partitions are found in, read by the partition > driver's own code through a new part_get_gpt(), which checks the sizes > too. When the primary GPT is not valid, measure the backup header as > the primary header that 'gpt repair' writes from it, so that PCR 5 is > as for the repaired disk; a primary header marked to be ignored > (ChromeOS) is never repaired, so measure the backup header as it is > then. If no valid GPT is read, measure no GPT event but return success, > so that the separators are still measured. > > EDK2 measures the GPT its partition driver uses too, since 7c12d4359abd > ("SecurityPkg/DxeTpm2MeasureBootLib: Use GptLib parser"), with the > primary header that driver restores from the backup. > > Add a sandbox test that checks PCR 5 for a valid GPT, an entry array > size that wraps, a backup GPT that differs from a broken primary one > and an ignored primary header, and check part_get_gpt() in > lib_test_gpt_sizes. > > Fixes: ce3dbc5d080d ("efi_loader: add UEFI GPT measurement") > Signed-off-by: Ana Bobillo <[email protected]> > > disk/part_efi.c | 27 +++++ > include/part.h | 27 +++++ > lib/efi_loader/efi_tcg2.c | 52 +++++---- > test/lib/part_efi.c | 61 +++++++++- > test/py/tests/test_efi_tcg2.py | 246 > +++++++++++++++++++++++++++++++++++++++++ > 5 files changed, 385 insertions(+), 28 deletions(-)
Reviewed-by: Simon Glass <[email protected]>
