From patchwork Wed May 12 04:57:51 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: AKASHI Takahiro X-Patchwork-Id: 435449 Delivered-To: patch@linaro.org Received: by 2002:a02:c901:0:0:0:0:0 with SMTP id t1csp4488913jao; Tue, 11 May 2021 21:58:52 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyfPXqXzSqZAMOHQo2WtEy2dk+6lxDcCoaxoLSr7rgj9S3YF1p7Zh7i7OacZhlrU1xMpMfH X-Received: by 2002:a17:906:80cd:: with SMTP id a13mr35230879ejx.109.1620795531977; Tue, 11 May 2021 21:58:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1620795531; cv=none; d=google.com; s=arc-20160816; b=Jl1uEADZBRRT3/Qnr2kF+nXZR7lcP/rM3lnmVT6RvVXLt0rz39x8y8zQzQ/8gNIrln MrH0v6oZPUFz/f7nqQrEU9DPi+6m6PLg9W78mZU7t1Pgd5xc8/qYP5o67BXA4QMG4zfG w/1BuRgk0mGTxV9YLRPBmZg8Hhq+Tmwa6wlsmlICmnOZG1UzuA727lVBaR5+5R2/ul8I XCTzr9/7XvcgM0m9oAR6yrIvAM7sufcbV9no6JIHPh861F2DAq/2ttM9KIn7fhYD3xO2 46xM1IehH+oL1NIBwXb4AaAzNNfCRCGLP2wUzvaYwHdxm5LrHL+eneWWaJxH0QknrNhe 9aZA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=zROjG3ewo5uhLB4jv/8e+Slu5BDSwvAWWVZQ1Gf79ZE=; b=yXNa9fJy5S2uoG31tACw0t1+qFX/B93+FAoHy2LItiuqhNPYYtVWXX2jM/kf8vOGfU ki8i5Qun70blcUog+5XwBYiRhpZgZo1dIsVHWTEcqvamxunbyDF+ZHCRb6JSicpCEAtU dmS2zHR/4K1P0LJzw8UxlAgDoURvF/NEwEW1xgRplrMPzlvzUev0Ev6KSAQ3xcvaNbIW NrFNQYyL/1Z67O0Xk+y64xyY8eSbLkZPGwU7qMhUvDiUhS3BMELM6X6uwLmyVStXkD1M fGYFChYmFGVP5Ma0xq2Lx2+k++BqZ8H5jcFJqtcMnTDld/SP3wQv1y6YXwvYO19jBsaP 9TMw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=T9z0Nc96; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [85.214.62.61]) by mx.google.com with ESMTPS id v18si7195297ejd.644.2021.05.11.21.58.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 May 2021 21:58:51 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) client-ip=85.214.62.61; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=T9z0Nc96; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 1937B82D4C; Wed, 12 May 2021 06:58:37 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="T9z0Nc96"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 2C2C382D13; Wed, 12 May 2021 06:58:33 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,SPF_HELO_NONE autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-pl1-x62b.google.com (mail-pl1-x62b.google.com [IPv6:2607:f8b0:4864:20::62b]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id DEBB282D13 for ; Wed, 12 May 2021 06:58:28 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=takahiro.akashi@linaro.org Received: by mail-pl1-x62b.google.com with SMTP id 69so7296979plc.5 for ; Tue, 11 May 2021 21:58:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=zROjG3ewo5uhLB4jv/8e+Slu5BDSwvAWWVZQ1Gf79ZE=; b=T9z0Nc96mSBfKc5hiyH2WmTJBrX/UlNVRyxht7sKZUSDfm+QkjLINdEODAiUw60zoj vzZJzYmqTVjpKWBH41yQWUjENp+Fkce1nwkcVMHZgw3GJ3Kq4DnlEQdr1Is2G23ot5I5 jyW2mYv+IVA38Nz9nQdGJodj+57H8muZMyQ0nZXjYJwGU9KAiXQrQnWiNYYUbiaJhvDi B9RxwzECOpMOYjQbSU23HYNsc1xUChSBuVHGH8G4E30Zjf8ObJn5EkMs+sxLT36+el30 ysNpR7FFfPvBYYHwmR0Ka5T8jBWrBaANFvn4pZ55YVbX4OpDTJ2L3E/a30P5pRTuF18f xBNQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=zROjG3ewo5uhLB4jv/8e+Slu5BDSwvAWWVZQ1Gf79ZE=; b=UPYXu+c9CHh2JABAYaxqheVZBqz6BrVJk4lQf/cUcI/3UNtbPQYPzpg4+BtpaAdHke FbH9J2nBYb1naviC1sBLZc9Q7l5qpUVo7ZfyDVXrTK9a/Tbvtc2Q1wLX2wh7sn0JTQP0 gF6+/hSioWUJTBYdga8yUPuU1ayll2sLYFvqcKGsQ/VIPPQ56jAcybsvNtVPmRHdoCBm C5kUR+69C6l5+9WKfKYWc/KaUqRbn4NffIAYxE+3ygSxYMUDXarlxZtavUD1ONg+O/d/ oOXoEZmqTTsMZfZdxFV2KJvd02VFlCjFwiGYmZ415qpsc9UGDxNdjJW9wJMtcKXjJ5qB mWQw== X-Gm-Message-State: AOAM533hVqZjXFWq/sN4qBXeS2grJmL2NepzKnWkN6wt0x7k7AaDr4R1 lXuurM/mkL0+Uw8zf22Ga7guMQ== X-Received: by 2002:a17:90a:fa0e:: with SMTP id cm14mr8876098pjb.59.1620795507163; Tue, 11 May 2021 21:58:27 -0700 (PDT) Received: from localhost.localdomain (p3dd30534.tkyea130.ap.so-net.ne.jp. [61.211.5.52]) by smtp.gmail.com with ESMTPSA id q194sm15188202pfc.62.2021.05.11.21.58.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 May 2021 21:58:26 -0700 (PDT) From: AKASHI Takahiro To: xypron.glpk@gmx.de, agraf@csgraf.de Cc: sughosh.ganu@linaro.org, masami.hiramatsu@linaro.org, u-boot@lists.denx.de, AKASHI Takahiro Subject: [PATCH 2/4] tools: mkeficapsule: remove device-tree related operation Date: Wed, 12 May 2021 13:57:51 +0900 Message-Id: <20210512045753.62288-3-takahiro.akashi@linaro.org> X-Mailer: git-send-email 2.31.0 In-Reply-To: <20210512045753.62288-1-takahiro.akashi@linaro.org> References: <20210512045753.62288-1-takahiro.akashi@linaro.org> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.102.4 at phobos.denx.de X-Virus-Status: Clean As we discussed, "-K" and "-D" options have nothing to do with creating a capsule file. The same result can be obtained by using standard commands like: === signature.dts === /dts-v1/; /plugin/; &{/} { signature { capsule-key = /incbin/("SIGNER.esl"); }; }; === $ dtc -@ -I dts -O dtb -o signature.dtbo signature.dts $ fdtoverlay -i test.dtb -o test_sig.dtb -v signature.dtbo So just remove this feature. (Effectively revert the commit 322c813f4bec ("mkeficapsule: Add support for embedding public key in a dtb").) The same feature is implemented by a shell script (tools/fdtsig.sh). Signed-off-by: AKASHI Takahiro --- Makefile | 7 +- tools/Makefile | 1 - tools/fdtsig.sh | 40 ++++++++ tools/mkeficapsule.c | 235 ++----------------------------------------- 4 files changed, 50 insertions(+), 233 deletions(-) create mode 100755 tools/fdtsig.sh -- 2.31.0 diff --git a/Makefile b/Makefile index 63b1f0143220..9806464357e0 100644 --- a/Makefile +++ b/Makefile @@ -1015,9 +1015,8 @@ cmd_pad_cat = $(cmd_objcopy) && $(append) || { rm -f $@; false; } quiet_cmd_lzma = LZMA $@ cmd_lzma = lzma -c -z -k -9 $< > $@ -quiet_cmd_mkeficapsule = MKEFICAPSULE $@ -cmd_mkeficapsule = $(objtree)/tools/mkeficapsule -K $(CONFIG_EFI_PKEY_FILE) \ - -D $@ +quiet_cmd_fdtsig = FDTSIG $@ +cmd_fdtsig = $(srctree)/tools/fdtsig.sh $(CONFIG_EFI_PKEY_FILE) $@ cfg: u-boot.cfg @@ -1114,7 +1113,7 @@ dtbs: dts/dt.dtb ifeq ($(CONFIG_EFI_CAPSULE_AUTHENTICATE)$(CONFIG_EFI_PKEY_DTB_EMBED),yy) dts/dt.dtb: u-boot tools $(Q)$(MAKE) $(build)=dts dtbs - $(call cmd,mkeficapsule) + $(call cmd,fdtsig) else dts/dt.dtb: u-boot $(Q)$(MAKE) $(build)=dts dtbs diff --git a/tools/Makefile b/tools/Makefile index 02eae0286e20..71a52719620c 100644 --- a/tools/Makefile +++ b/tools/Makefile @@ -235,7 +235,6 @@ ifneq ($(CONFIG_EFI_CAPSULE_AUTHENTICATE),) HOSTLDLIBS_mkeficapsule += \ $(shell pkg-config --libs libssl libcrypto 2> /dev/null || echo "-lssl -lcrypto") endif -mkeficapsule-objs := mkeficapsule.o $(LIBFDT_OBJS) hostprogs-$(CONFIG_EFI_HAVE_CAPSULE_SUPPORT) += mkeficapsule # We build some files with extra pedantic flags to try to minimize things diff --git a/tools/fdtsig.sh b/tools/fdtsig.sh new file mode 100755 index 000000000000..aaa0a9190845 --- /dev/null +++ b/tools/fdtsig.sh @@ -0,0 +1,40 @@ +#!/bin/sh +# SPDX-License-Identifier: GPL-2.0+ +# +# script to add a certificate (efi-signature-list) to dtb blob + +usage() { + if [ -n "$*" ]; then + echo "ERROR: $*" + fi + echo "Usage: "$(basename $0) " " +} + +if [ "$#" -ne 2 ]; then + usage "Arguments missing" + exit 1 +fi + +ESL=$1 +DTB=$2 +NEW_DTB=$(basename $DTB)_tmp +SIG=signature + +cat << 'EOF' > $SIG.dts +/dts-v1/; +/plugin/; + +&{/} { + signature { + capsule-key = /incbin/("ESL"); + }; +}; +EOF + +sed -in "s/ESL/$ESL/" $SIG.dts + +dtc -@ -I dts -O dtb -o $SIG.dtbo $SIG.dts +fdtoverlay -i $DTB -o $NEW_DTB -v $SIG.dtbo +mv $NEW_DTB $DTB + +rm $SIG.dts $SIG.dtbo $NEW_DTB diff --git a/tools/mkeficapsule.c b/tools/mkeficapsule.c index 34ff1bdd82eb..97ce68ec83ee 100644 --- a/tools/mkeficapsule.c +++ b/tools/mkeficapsule.c @@ -4,17 +4,13 @@ * Author: AKASHI Takahiro */ -#include #include #include #include #include #include #include -#include #include - -#include #include #include @@ -28,8 +24,6 @@ #include #endif -#include - typedef __u8 u8; typedef __u16 u16; typedef __u32 u32; @@ -39,9 +33,6 @@ typedef __s32 s32; #define aligned_u64 __aligned_u64 -#define SIGNATURE_NODENAME "signature" -#define OVERLAY_NODENAME "__overlay__" - #ifndef __packed #define __packed __attribute__((packed)) #endif @@ -59,9 +50,9 @@ efi_guid_t efi_guid_image_type_uboot_raw = efi_guid_t efi_guid_cert_type_pkcs7 = EFI_CERT_TYPE_PKCS7_GUID; #if IS_ENABLED(CONFIG_EFI_CAPSULE_AUTHENTICATE) -static const char *opts_short = "f:r:i:I:v:D:K:P:C:m:dOh"; +static const char *opts_short = "f:r:i:I:v:P:C:m:dh"; #else -static const char *opts_short = "f:r:i:I:v:D:K:Oh"; +static const char *opts_short = "f:r:i:I:v:h"; #endif static struct option options[] = { @@ -69,15 +60,12 @@ static struct option options[] = { {"raw", required_argument, NULL, 'r'}, {"index", required_argument, NULL, 'i'}, {"instance", required_argument, NULL, 'I'}, - {"dtb", required_argument, NULL, 'D'}, - {"public key", required_argument, NULL, 'K'}, #if IS_ENABLED(CONFIG_EFI_CAPSULE_AUTHENTICATE) {"private-key", required_argument, NULL, 'P'}, {"certificate", required_argument, NULL, 'C'}, {"monotonic-count", required_argument, NULL, 'm'}, {"dump-sig", no_argument, NULL, 'd'}, #endif - {"overlay", no_argument, NULL, 'O'}, {"help", no_argument, NULL, 'h'}, {NULL, 0, NULL, 0}, }; @@ -104,180 +92,6 @@ static void print_usage(void) tool_name); } -static int fdt_add_pub_key_data(void *sptr, void *dptr, size_t key_size, - bool overlay) -{ - int parent; - int ov_node; - int frag_node; - int ret = 0; - - if (overlay) { - /* - * The signature would be stored in the - * first fragment node of the overlay - */ - frag_node = fdt_first_subnode(dptr, 0); - if (frag_node == -FDT_ERR_NOTFOUND) { - fprintf(stderr, - "Couldn't find the fragment node: %s\n", - fdt_strerror(frag_node)); - goto done; - } - - ov_node = fdt_subnode_offset(dptr, frag_node, OVERLAY_NODENAME); - if (ov_node == -FDT_ERR_NOTFOUND) { - fprintf(stderr, - "Couldn't find the __overlay__ node: %s\n", - fdt_strerror(ov_node)); - goto done; - } - } else { - ov_node = 0; - } - - parent = fdt_subnode_offset(dptr, ov_node, SIGNATURE_NODENAME); - if (parent == -FDT_ERR_NOTFOUND) { - parent = fdt_add_subnode(dptr, ov_node, SIGNATURE_NODENAME); - if (parent < 0) { - ret = parent; - if (ret != -FDT_ERR_NOSPACE) { - fprintf(stderr, - "Couldn't create signature node: %s\n", - fdt_strerror(parent)); - } - } - } - if (ret) - goto done; - - /* Write the key to the FDT node */ - ret = fdt_setprop(dptr, parent, "capsule-key", - sptr, key_size); - -done: - if (ret) - ret = ret == -FDT_ERR_NOSPACE ? -ENOSPC : -EIO; - - return ret; -} - -static int add_public_key(const char *pkey_file, const char *dtb_file, - bool overlay) -{ - int ret; - int srcfd = -1; - int destfd = -1; - void *sptr = NULL; - void *dptr = NULL; - off_t src_size; - struct stat pub_key; - struct stat dtb; - - /* Find out the size of the public key */ - srcfd = open(pkey_file, O_RDONLY); - if (srcfd == -1) { - fprintf(stderr, "%s: Can't open %s: %s\n", - __func__, pkey_file, strerror(errno)); - ret = -1; - goto err; - } - - ret = fstat(srcfd, &pub_key); - if (ret == -1) { - fprintf(stderr, "%s: Can't stat %s: %s\n", - __func__, pkey_file, strerror(errno)); - ret = -1; - goto err; - } - - src_size = pub_key.st_size; - - /* mmap the public key esl file */ - sptr = mmap(0, src_size, PROT_READ, MAP_SHARED, srcfd, 0); - if (sptr == MAP_FAILED) { - fprintf(stderr, "%s: Failed to mmap %s:%s\n", - __func__, pkey_file, strerror(errno)); - ret = -1; - goto err; - } - - /* Open the dest FDT */ - destfd = open(dtb_file, O_RDWR); - if (destfd == -1) { - fprintf(stderr, "%s: Can't open %s: %s\n", - __func__, dtb_file, strerror(errno)); - ret = -1; - goto err; - } - - ret = fstat(destfd, &dtb); - if (ret == -1) { - fprintf(stderr, "%s: Can't stat %s: %s\n", - __func__, dtb_file, strerror(errno)); - goto err; - } - - dtb.st_size += src_size + 0x30; - if (ftruncate(destfd, dtb.st_size)) { - fprintf(stderr, "%s: Can't expand %s: %s\n", - __func__, dtb_file, strerror(errno)); - ret = -1; - goto err; - } - - errno = 0; - /* mmap the dtb file */ - dptr = mmap(0, dtb.st_size, PROT_READ | PROT_WRITE, MAP_SHARED, - destfd, 0); - if (dptr == MAP_FAILED) { - fprintf(stderr, "%s: Failed to mmap %s:%s\n", - __func__, dtb_file, strerror(errno)); - ret = -1; - goto err; - } - - if (fdt_check_header(dptr)) { - fprintf(stderr, "%s: Invalid FDT header\n", __func__); - ret = -1; - goto err; - } - - ret = fdt_open_into(dptr, dptr, dtb.st_size); - if (ret) { - fprintf(stderr, "%s: Cannot expand FDT: %s\n", - __func__, fdt_strerror(ret)); - ret = -1; - goto err; - } - - /* Copy the esl file to the expanded FDT */ - ret = fdt_add_pub_key_data(sptr, dptr, src_size, overlay); - if (ret < 0) { - fprintf(stderr, "%s: Unable to add public key to the FDT\n", - __func__); - ret = -1; - goto err; - } - - ret = 0; - -err: - if (sptr) - munmap(sptr, src_size); - - if (dptr) - munmap(dptr, dtb.st_size); - - if (srcfd != -1) - close(srcfd); - - if (destfd != -1) - close(destfd); - - return ret; -} - struct auth_context { char *key_file; char *cert_file; @@ -608,19 +422,13 @@ err_1: int main(int argc, char **argv) { char *file; - char *pkey_file; - char *dtb_file; efi_guid_t *guid; unsigned long index, instance; uint64_t mcount; char *privkey_file, *cert_file; int c, idx; - int ret; - bool overlay = false; file = NULL; - pkey_file = NULL; - dtb_file = NULL; guid = NULL; index = 0; instance = 0; @@ -656,20 +464,6 @@ int main(int argc, char **argv) case 'I': instance = strtoul(optarg, NULL, 0); break; - case 'K': - if (pkey_file) { - printf("Public Key already specified\n"); - return -1; - } - pkey_file = optarg; - break; - case 'D': - if (dtb_file) { - printf("DTB file already specified\n"); - return -1; - } - dtb_file = optarg; - break; #if IS_ENABLED(CONFIG_EFI_CAPSULE_AUTHENTICATE) case 'P': if (privkey_file) { @@ -692,9 +486,6 @@ int main(int argc, char **argv) dump_sig = 1; break; #endif - case 'O': - overlay = true; - break; case 'h': print_usage(); return 0; @@ -702,27 +493,15 @@ int main(int argc, char **argv) } /* check necessary parameters */ - if ((file && (!(optind < argc) || - (privkey_file && !cert_file) || - (!privkey_file && cert_file))) || - ((pkey_file && !dtb_file) || - (!pkey_file && dtb_file))) { + if (file && (!(optind < argc) || + (privkey_file && !cert_file) || + (!privkey_file && cert_file))) { print_usage(); exit(EXIT_FAILURE); } - if (pkey_file && dtb_file) { - ret = add_public_key(pkey_file, dtb_file, overlay); - if (ret == -1) { - printf("Adding public key to the dtb failed\n"); - exit(EXIT_FAILURE); - } - } - - if (optind < argc && - create_fwbin(argv[optind], file, guid, index, instance, - mcount, privkey_file, cert_file) - < 0) { + if (create_fwbin(argv[optind], file, guid, index, instance, + mcount, privkey_file, cert_file) < 0) { printf("Creating firmware capsule failed\n"); exit(EXIT_FAILURE); }