From patchwork Thu Apr 30 17:36:26 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sughosh Ganu X-Patchwork-Id: 1280723 X-Patchwork-Delegate: xypron.glpk@gmx.de Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de (client-ip=85.214.62.61; helo=phobos.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=linaro.org Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 49CjK532K5z9sSM for ; Fri, 1 May 2020 03:38:17 +1000 (AEST) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id ED6618221C; Thu, 30 Apr 2020 19:37:17 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=fail (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Received: by phobos.denx.de (Postfix, from userid 109) id 572538221D; Thu, 30 Apr 2020 19:37:06 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,SPF_HELO_NONE, URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.2 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by phobos.denx.de (Postfix) with ESMTP id 91BCD8217A for ; Thu, 30 Apr 2020 19:36:53 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=fail (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=fail smtp.mailfrom=sughosh.ganu@linaro.org Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 55C9811B3; Thu, 30 Apr 2020 10:36:51 -0700 (PDT) Received: from a076522.blr.arm.com (a076522.blr.arm.com [10.162.16.44]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 381073F73D; Thu, 30 Apr 2020 10:36:48 -0700 (PDT) From: Sughosh Ganu To: u-boot@lists.denx.de Cc: Heinrich Schuchardt , Akashi Takahiro , Grant Likely , Tuomas Tynkkynen , Tom Rini , Sughosh Ganu Subject: [PATCH 4/8] efi_loader: Allow parsing of miscellaneous signature database variables Date: Thu, 30 Apr 2020 23:06:26 +0530 Message-Id: <20200430173630.15608-5-sughosh.ganu@linaro.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20200430173630.15608-1-sughosh.ganu@linaro.org> References: <20200430173630.15608-1-sughosh.ganu@linaro.org> X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.30rc1 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.102.2 at phobos.denx.de X-Virus-Status: Clean The current function to parse the signature database(sigdb) only allows parsing of secure boot related sigdb variables, namely PK, KEK, db and dbx. Allow the function to parse any other sigdb variables. This would be useful for the capsule authenticate feature, which would be storing it's root certificate in a non secure-boot sigdb. This is done by passing the vendor guid as a function argument. Signed-off-by: Sughosh Ganu --- include/efi_loader.h | 3 ++- lib/efi_loader/efi_image_loader.c | 11 +++++++---- lib/efi_loader/efi_signature.c | 14 +++----------- lib/efi_loader/efi_variable.c | 9 ++++++--- 4 files changed, 18 insertions(+), 19 deletions(-) diff --git a/include/efi_loader.h b/include/efi_loader.h index ad99ab660f..b7638d5825 100644 --- a/include/efi_loader.h +++ b/include/efi_loader.h @@ -774,7 +774,8 @@ efi_status_t efi_image_region_add(struct efi_image_regions *regs, int nocheck); void efi_sigstore_free(struct efi_signature_store *sigstore); -struct efi_signature_store *efi_sigstore_parse_sigdb(u16 *name); +struct efi_signature_store *efi_sigstore_parse_sigdb(u16 *name, + const efi_guid_t *vendor); bool efi_secure_boot_enabled(void); diff --git a/lib/efi_loader/efi_image_loader.c b/lib/efi_loader/efi_image_loader.c index 6c270ce94f..e07dc290a3 100644 --- a/lib/efi_loader/efi_image_loader.c +++ b/lib/efi_loader/efi_image_loader.c @@ -418,13 +418,15 @@ static bool efi_image_unsigned_authenticate(struct efi_image_regions *regs) struct efi_signature_store *db = NULL, *dbx = NULL; bool ret = false; - dbx = efi_sigstore_parse_sigdb(L"dbx"); + dbx = efi_sigstore_parse_sigdb(L"dbx", + &efi_guid_image_security_database); if (!dbx) { debug("Getting signature database(dbx) failed\n"); goto out; } - db = efi_sigstore_parse_sigdb(L"db"); + db = efi_sigstore_parse_sigdb(L"db", + &efi_guid_image_security_database); if (!db) { debug("Getting signature database(db) failed\n"); goto out; @@ -515,13 +517,14 @@ static bool efi_image_authenticate(void *efi, size_t efi_size) /* * verify signature using db and dbx */ - db = efi_sigstore_parse_sigdb(L"db"); + db = efi_sigstore_parse_sigdb(L"db", &efi_guid_image_security_database); if (!db) { debug("Getting signature database(db) failed\n"); goto err; } - dbx = efi_sigstore_parse_sigdb(L"dbx"); + dbx = efi_sigstore_parse_sigdb(L"dbx", + &efi_guid_image_security_database); if (!dbx) { debug("Getting signature database(dbx) failed\n"); goto err; diff --git a/lib/efi_loader/efi_signature.c b/lib/efi_loader/efi_signature.c index 658e3547da..bf6f39aab2 100644 --- a/lib/efi_loader/efi_signature.c +++ b/lib/efi_loader/efi_signature.c @@ -714,30 +714,22 @@ err: /** * efi_sigstore_parse_sigdb - parse a signature database variable * @name: Variable's name + * @vendor: Vendor guid * * Read in a value of signature database variable pointed to by * @name, parse it and instantiate a signature store structure. * * Return: Pointer to signature store on success, NULL on error */ -struct efi_signature_store *efi_sigstore_parse_sigdb(u16 *name) +struct efi_signature_store *efi_sigstore_parse_sigdb( + u16 *name, const efi_guid_t *vendor) { struct efi_signature_store *sigstore = NULL, *siglist; struct efi_signature_list *esl; - const efi_guid_t *vendor; void *db; efi_uintn_t db_size; efi_status_t ret; - if (!u16_strcmp(name, L"PK") || !u16_strcmp(name, L"KEK")) { - vendor = &efi_global_variable_guid; - } else if (!u16_strcmp(name, L"db") || !u16_strcmp(name, L"dbx")) { - vendor = &efi_guid_image_security_database; - } else { - debug("unknown signature database, %ls\n", name); - return NULL; - } - /* retrieve variable data */ db_size = 0; ret = EFI_CALL(efi_get_variable(name, vendor, NULL, &db_size, NULL)); diff --git a/lib/efi_loader/efi_variable.c b/lib/efi_loader/efi_variable.c index 7df881a74b..6c2dd82306 100644 --- a/lib/efi_loader/efi_variable.c +++ b/lib/efi_loader/efi_variable.c @@ -604,14 +604,17 @@ static efi_status_t efi_variable_authenticate(u16 *variable, if (u16_strcmp(variable, L"PK") == 0 || u16_strcmp(variable, L"KEK") == 0) { /* with PK */ - truststore = efi_sigstore_parse_sigdb(L"PK"); + truststore = efi_sigstore_parse_sigdb(L"PK", + &efi_global_variable_guid); if (!truststore) goto err; } else if (u16_strcmp(variable, L"db") == 0 || u16_strcmp(variable, L"dbx") == 0) { /* with PK and KEK */ - truststore = efi_sigstore_parse_sigdb(L"KEK"); - truststore2 = efi_sigstore_parse_sigdb(L"PK"); + truststore = efi_sigstore_parse_sigdb(L"KEK", + &efi_global_variable_guid); + truststore2 = efi_sigstore_parse_sigdb(L"PK", + &efi_global_variable_guid); if (!truststore) { if (!truststore2)