From mboxrd@z Thu Jan  1 00:00:00 1970
From: AKASHI Takahiro <takahiro.akashi@linaro.org>
Date: Tue, 21 Jan 2020 15:00:09 +0900
Subject: [PATCH v4 03/16] efi_loader: add signature verification functions
In-Reply-To: <e83852eb-0951-d6d4-ca47-ad01cfcbd1be@gmx.de>
References: <20191218004512.24939-1-takahiro.akashi@linaro.org>
 <20191218004512.24939-4-takahiro.akashi@linaro.org>
 <a24badf7-ffbd-ad58-cc59-f3dde0e9c43b@gmx.de>
 <2a71eab4-8acf-b849-b632-163cb4dbdfe8@gmx.de>
 <20200117021959.GJ28530@linaro.org>
 <e83852eb-0951-d6d4-ca47-ad01cfcbd1be@gmx.de>
Message-ID: <20200121060008.GD8146@linaro.org>
List-Id: <u-boot.lists.denx.de>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
To: u-boot@lists.denx.de

On Fri, Jan 17, 2020 at 06:37:39AM +0100, Heinrich Schuchardt wrote:
> On 1/17/20 3:20 AM, AKASHI Takahiro wrote:
> >On Wed, Jan 15, 2020 at 01:13:36AM +0100, Heinrich Schuchardt wrote:
> >>On 1/15/20 12:43 AM, Heinrich Schuchardt wrote:
> >>>On 12/18/19 1:44 AM, AKASHI Takahiro wrote:
> >(snip)
> >>>>diff --git a/lib/efi_loader/efi_signature.c
> >>>>b/lib/efi_loader/efi_signature.c
> >>>>new file mode 100644
> >>>>index 000000000000..823d3311e010
> >>>>--- /dev/null
> >>>>+++ b/lib/efi_loader/efi_signature.c
> >>>>@@ -0,0 +1,584 @@
> >>>>+// SPDX-License-Identifier: GPL-2.0+
> >>>>+/*
> >>>>+ * Copyright (c) 2018 Patrick Wildt <patrick@blueri.se>
> >>>>+ * Copyright (c) 2019 Linaro Limited, Author: AKASHI Takahiro
> >>>>+ */
> >>>>+
> >>>>+#include <common.h>
> >>>>+#include <charset.h>
> >>>>+#include <efi_loader.h>
> >>>>+#include <image.h>
> >>>>+#include <hexdump.h>
> >>>>+#include <malloc.h>
> >>>>+#include <pe.h>
> >>>>+#include <linux/compat.h>
> >>>>+#include <linux/oid_registry.h>
> >>>>+#include <u-boot/rsa.h>
> >>>>+#include <u-boot/sha256.h>
> >>>>+/*
> >>>>+ * avoid duplicated inclusion:
> >>>>+ * #include "../lib/crypto/x509_parser.h"
> >>>>+ */
> >>>>+#include "../lib/crypto/pkcs7_parser.h"
> >>>>+
> >>>>+const efi_guid_t efi_guid_image_security_database =
> >>>>+        EFI_IMAGE_SECURITY_DATABASE_GUID;
> >>>>+const efi_guid_t efi_guid_sha256 = EFI_CERT_SHA256_GUID;
> >>>>+const efi_guid_t efi_guid_cert_rsa2048 = EFI_CERT_RSA2048_GUID;
> >>>>+const efi_guid_t efi_guid_cert_x509 = EFI_CERT_X509_GUID;
> >>>>+const efi_guid_t efi_guid_cert_x509_sha256 = EFI_CERT_X509_SHA256_GUID;
> >>>>+
> >>>>+#ifdef CONFIG_EFI_SECURE_BOOT
> >>
> >>This is the #ifdef to move to the Makefile. In the previous mail I got
> >>into the wrong line.
> >
> >No.
> >As you can see, those guids may also be referred to by other files
> >(see efi_variable.c and cmd/nvedit_efi.c)
> >even in !EFI_SECURE_BOOT case, and I think that this file is best fit
> >for them.
> 
> I cannot find any of these guids in any other C file after applying all
> patches from

???
Did you look for efi_guid_image_security_database in efi_variable.c
and cmd/nvedit_efi.c?

-Takahiro Akashi


> https://patchwork.ozlabs.org/project/uboot/list/?series=&submitter=61166&state=&q=&archive=&delegate=
> 
> git grep -n efi_guid_sha256
> include/efi_loader.h:185:extern const efi_guid_t efi_guid_sha256;
> lib/efi_loader/efi_signature.c:26:const efi_guid_t efi_guid_sha256 =
> EFI_CERT_SHA256_GUID;
> lib/efi_loader/efi_signature.c:252:             if
> (guidcmp(&siglist->sig_type, &efi_guid_sha256)) {
> 
> lib/efi_loader/efi_signature.c:27:const efi_guid_t efi_guid_cert_rsa2048
> = EFI_CERT_RSA2048_GUID;
> 
> git grep -n efi_guid_cert_x509
> include/efi_loader.h:186:extern const efi_guid_t efi_guid_cert_x509;
> include/efi_loader.h:187:extern const efi_guid_t efi_guid_cert_x509_sha256;
> lib/efi_loader/efi_signature.c:28:const efi_guid_t efi_guid_cert_x509 =
> EFI_CERT_X509_GUID;
> lib/efi_loader/efi_signature.c:29:const efi_guid_t
> efi_guid_cert_x509_sha256 = EFI_CERT_X509_SHA256_GUID;
> lib/efi_loader/efi_signature.c:283:     if (guidcmp(&siglist->sig_type,
> &efi_guid_cert_x509)) {
> lib/efi_loader/efi_signature.c:406:     if (guidcmp(&siglist->sig_type,
> &efi_guid_cert_x509_sha256)) {
> 
> include/efi_loader.h:187:extern const efi_guid_t efi_guid_cert_x509_sha256;
> lib/efi_loader/efi_signature.c:29:const efi_guid_t
> efi_guid_cert_x509_sha256 = EFI_CERT_X509_SHA256_GUID;
> lib/efi_loader/efi_signature.c:406:     if (guidcmp(&siglist->sig_type,
> &efi_guid_cert_x509_sha256)) {
> 
> Best regards
> 
> Heinrich