Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1523715 > unrolled thread

[PATCH 6/9] efi: Add EFI signature data types

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  [PATCH 6/9] efi: Add EFI signature data types David Howells <dhowells@redhat.com> - 2016-11-16 19:20 +0100
    Re: [PATCH 6/9] efi: Add EFI signature data types Mat Martineau <mathew.j.martineau@linux.intel.com> - 2016-11-17 00:50 +0100
      Re: [PATCH 6/9] efi: Add EFI signature data types David Howells <dhowells@redhat.com> - 2016-11-17 10:50 +0100
        Re: [PATCH 6/9] efi: Add EFI signature data types Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2016-11-21 17:10 +0100

#1523715 — [PATCH 6/9] efi: Add EFI signature data types

From: Dave Howells <dhowells@redhat.com>

Add the data types that are used for containing hashes, keys and
certificates for cryptographic verification along with their corresponding
type GUIDs.

Signed-off-by: David Howells <dhowells@redhat.com>
---

 include/linux/efi.h |   24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/include/linux/efi.h b/include/linux/efi.h
index acfdea8381de..6fb50bafedc7 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -594,6 +594,9 @@ void efi_native_runtime_setup(void);
 
 #define EFI_IMAGE_SECURITY_DATABASE_GUID	EFI_GUID(0xd719b2cb, 0x3d3a, 0x4596, 0xa3, 0xbc, 0xda, 0xd0, 0x0e, 0x67, 0x65, 0x6f)
 #define EFI_SHIM_LOCK_GUID			EFI_GUID(0x605dab50, 0xe046, 0x4300, 0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23)
+#define EFI_CERT_SHA256_GUID			EFI_GUID(0xc1c41626, 0x504c, 0x4092, 0xac, 0xa9, 0x41, 0xf9, 0x36, 0x93, 0x43, 0x28 )
+#define EFI_CERT_X509_GUID			EFI_GUID(0xa5c059a1, 0x94e4, 0x4aa7, 0x87, 0xb5, 0xab, 0x15, 0x5c, 0x2b, 0xf0, 0x72 )
+#define EFI_CERT_X509_SHA256_GUID		EFI_GUID(0x3bd2a492, 0x96c0, 0x4079, 0xb4, 0x20, 0xfc, 0xf9, 0x8e, 0xf1, 0x03, 0xed );
 
 /*
  * This GUID is used to pass to the kernel proper the struct screen_info
@@ -853,6 +856,27 @@ typedef struct {
 	efi_memory_desc_t entry[0];
 } efi_memory_attributes_table_t;
 
+typedef struct  {
+	efi_guid_t signature_owner;
+	u8 signature_data[];
+} efi_signature_data_t;
+
+typedef struct {
+	efi_guid_t signature_type;
+	u32 signature_list_size;
+	u32 signature_header_size;
+	u32 signature_size;
+	u8 signature_header[];
+	/* efi_signature_data_t signatures[][] */
+} efi_signature_list_t;
+
+typedef u8 efi_sha256_hash_t[32];
+
+typedef struct {
+	efi_sha256_hash_t to_be_signed_hash;
+	efi_time_t time_of_revocation;
+} efi_cert_x509_sha256_t;
+
 /*
  * All runtime access to EFI goes through this structure:
  */

[toc] | [next] | [standalone]

#1523969

David,

On Wed, 16 Nov 2016, David Howells wrote:

> From: Dave Howells <dhowells@redhat.com>
>
> Add the data types that are used for containing hashes, keys and
> certificates for cryptographic verification along with their corresponding
> type GUIDs.
>
> Signed-off-by: David Howells <dhowells@redhat.com>
> ---
>
> include/linux/efi.h |   24 ++++++++++++++++++++++++
> 1 file changed, 24 insertions(+)
>
> diff --git a/include/linux/efi.h b/include/linux/efi.h
> index acfdea8381de..6fb50bafedc7 100644
> --- a/include/linux/efi.h
> +++ b/include/linux/efi.h
> @@ -594,6 +594,9 @@ void efi_native_runtime_setup(void);
>
> #define EFI_IMAGE_SECURITY_DATABASE_GUID	EFI_GUID(0xd719b2cb, 0x3d3a, 0x4596, 0xa3, 0xbc, 0xda, 0xd0, 0x0e, 0x67, 0x65, 0x6f)
> #define EFI_SHIM_LOCK_GUID			EFI_GUID(0x605dab50, 0xe046, 0x4300, 0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23)
> +#define EFI_CERT_SHA256_GUID			EFI_GUID(0xc1c41626, 0x504c, 0x4092, 0xac, 0xa9, 0x41, 0xf9, 0x36, 0x93, 0x43, 0x28 )
> +#define EFI_CERT_X509_GUID			EFI_GUID(0xa5c059a1, 0x94e4, 0x4aa7, 0x87, 0xb5, 0xab, 0x15, 0x5c, 0x2b, 0xf0, 0x72 )
> +#define EFI_CERT_X509_SHA256_GUID		EFI_GUID(0x3bd2a492, 0x96c0, 0x4079, 0xb4, 0x20, 0xfc, 0xf9, 0x8e, 0xf1, 0x03, 0xed );

The trailing ';' on EFI_CERT_X509_SHA256_GUID could trip someone up later. 
As long as you're fixing that, the spaces before the closing parens are 
inconsistent with the other GUID definitions in this file.

> /*
>  * This GUID is used to pass to the kernel proper the struct screen_info
> @@ -853,6 +856,27 @@ typedef struct {
> 	efi_memory_desc_t entry[0];
> } efi_memory_attributes_table_t;
>
> +typedef struct  {
> +	efi_guid_t signature_owner;
> +	u8 signature_data[];
> +} efi_signature_data_t;
> +
> +typedef struct {
> +	efi_guid_t signature_type;
> +	u32 signature_list_size;
> +	u32 signature_header_size;
> +	u32 signature_size;
> +	u8 signature_header[];
> +	/* efi_signature_data_t signatures[][] */
> +} efi_signature_list_t;
> +
> +typedef u8 efi_sha256_hash_t[32];
> +
> +typedef struct {
> +	efi_sha256_hash_t to_be_signed_hash;
> +	efi_time_t time_of_revocation;
> +} efi_cert_x509_sha256_t;
> +
> /*
>  * All runtime access to EFI goes through this structure:
>  */

--
Mat Martineau
Intel OTC

[toc] | [prev] | [next] | [standalone]

#1524207

Mat Martineau <mathew.j.martineau@linux.intel.com> wrote:

> The trailing ';' on EFI_CERT_X509_SHA256_GUID could trip someone up later. As
> long as you're fixing that, the spaces before the closing parens are
> inconsistent with the other GUID definitions in this file.

Fixed, thanks.

David

[toc] | [prev] | [next] | [standalone]

#1526857

On 17 November 2016 at 09:44, David Howells <dhowells@redhat.com> wrote:
> Mat Martineau <mathew.j.martineau@linux.intel.com> wrote:
>
>> The trailing ';' on EFI_CERT_X509_SHA256_GUID could trip someone up later. As
>> long as you're fixing that, the spaces before the closing parens are
>> inconsistent with the other GUID definitions in this file.
>
> Fixed, thanks.
>

With the fix

Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web