On 5/12/21 6:57 AM, AKASHI Takahiro wrote:
This command allows us to add a certificate (or public key) to dtb blob:
{
        signature {
                capsule-key = "...";
        };
}

The value is actually a signature list in terms of UEFI specificaion,
and used in verifying UEFI capsules.

The code was originally developed by Sughosh and derived from
mkeficapsule.c.

I have no clue how you want to use this command. Please, provide a
description of the workflow using this command.

In your comments for patch 2 you wrote that the -K and -D option can be
replaced by tools provided by the device-tree compiler package. Why do
they reappear here?

Please, add a man-page (/doc/fdtsig.1).



Signed-off-by: AKASHI Takahiro <takahiro.aka...@linaro.org>
---
  Makefile       |   2 +-
  tools/Makefile |   2 +
  tools/fdtsig.c | 274 +++++++++++++++++++++++++++++++++++++++++++++++++
  3 files changed, 277 insertions(+), 1 deletion(-)
  create mode 100644 tools/fdtsig.c

diff --git a/Makefile b/Makefile
index 9806464357e0..8b40987234a0 100644
--- a/Makefile
+++ b/Makefile
@@ -1016,7 +1016,7 @@ quiet_cmd_lzma = LZMA    $@
  cmd_lzma = lzma -c -z -k -9 $< > $@

  quiet_cmd_fdtsig = FDTSIG  $@
-cmd_fdtsig = $(srctree)/tools/fdtsig.sh $(CONFIG_EFI_PKEY_FILE) $@
+cmd_fdtsig = $(objtree)/tools/fdtsig -K $(CONFIG_EFI_PKEY_FILE) -D $@

  cfg: u-boot.cfg

diff --git a/tools/Makefile b/tools/Makefile
index 71a52719620c..e6fd1dbade19 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -234,6 +234,8 @@ HOSTCFLAGS_asn1_compiler.o = -idirafter $(srctree)/include
  ifneq ($(CONFIG_EFI_CAPSULE_AUTHENTICATE),)
  HOSTLDLIBS_mkeficapsule += \
        $(shell pkg-config --libs libssl libcrypto 2> /dev/null || echo "-lssl 
-lcrypto")
+       fdtsig-objs     := fdtsig.o $(LIBFDT_OBJS)
+       hostprogs-y += fdtsig
  endif
  hostprogs-$(CONFIG_EFI_HAVE_CAPSULE_SUPPORT) += mkeficapsule

diff --git a/tools/fdtsig.c b/tools/fdtsig.c
new file mode 100644
index 000000000000..daa1e63c3b33
--- /dev/null
+++ b/tools/fdtsig.c
@@ -0,0 +1,274 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright 2021 Linaro Limited
+ * The code in this file was extracted from mkeficapsule.c

That information is better described by the git log.

Please, explain here what this tool is used for.

Best regards

Heinrich

+ */
+
+#include <errno.h>
+#include <fcntl.h>
+#include <getopt.h>
+#include <malloc.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <unistd.h>
+
+#include <sys/mman.h>
+#include <sys/stat.h>
+
+#include <linux/libfdt.h>
+
+#define SIGNATURE_NODENAME     "signature"
+#define OVERLAY_NODENAME       "__overlay__"
+
+static const char *tool_name = "fdtsig";
+
+static const char *opts_short = "D:K:Oh";
+
+static struct option options[] = {
+       {"dtb", required_argument, NULL, 'D'},
+       {"public key", required_argument, NULL, 'K'},
+       {"overlay", no_argument, NULL, 'O'},
+       {"help", no_argument, NULL, 'h'},
+       {NULL, 0, NULL, 0},
+};
+
+static void print_usage(void)
+{
+       printf("Usage: %s [options]\n"
+              "Options:\n"
+
+              "\t-K, --public-key <key file> public key esl file\n"
+              "\t-D, --dtb <dtb file>        dtb file\n"
+              "\t-O, --overlay               the dtb file is an overlay\n"
+              "\t-h, --help                  print a help message\n",
+              tool_name);
+}
+
+static int fdt_add_pub_key_data(void *sptr, void *dptr, size_t key_size,
+                               bool overlay)
+{
+       int parent;
+       int ov_node;
+       int frag_node;
+       int ret = 0;
+
+       if (overlay) {
+               /*
+                * The signature would be stored in the
+                * first fragment node of the overlay
+                */
+               frag_node = fdt_first_subnode(dptr, 0);
+               if (frag_node == -FDT_ERR_NOTFOUND) {
+                       fprintf(stderr,
+                               "Couldn't find the fragment node: %s\n",
+                               fdt_strerror(frag_node));
+                       goto done;
+               }
+
+               ov_node = fdt_subnode_offset(dptr, frag_node, OVERLAY_NODENAME);
+               if (ov_node == -FDT_ERR_NOTFOUND) {
+                       fprintf(stderr,
+                               "Couldn't find the __overlay__ node: %s\n",
+                               fdt_strerror(ov_node));
+                       goto done;
+               }
+       } else {
+               ov_node = 0;
+       }
+
+       parent = fdt_subnode_offset(dptr, ov_node, SIGNATURE_NODENAME);
+       if (parent == -FDT_ERR_NOTFOUND) {
+               parent = fdt_add_subnode(dptr, ov_node, SIGNATURE_NODENAME);
+               if (parent < 0) {
+                       ret = parent;
+                       if (ret != -FDT_ERR_NOSPACE) {
+                               fprintf(stderr,
+                                       "Couldn't create signature node: %s\n",
+                                       fdt_strerror(parent));
+                       }
+               }
+       }
+       if (ret)
+               goto done;
+
+       /* Write the key to the FDT node */
+       ret = fdt_setprop(dptr, parent, "capsule-key",
+                         sptr, key_size);
+
+done:
+       if (ret)
+               ret = ret == -FDT_ERR_NOSPACE ? -ENOSPC : -EIO;
+
+       return ret;
+}
+
+static int add_public_key(const char *pkey_file, const char *dtb_file,
+                         bool overlay)
+{
+       int ret;
+       int srcfd = -1;
+       int destfd = -1;
+       void *sptr = NULL;
+       void *dptr = NULL;
+       off_t src_size;
+       struct stat pub_key;
+       struct stat dtb;
+
+       /* Find out the size of the public key */
+       srcfd = open(pkey_file, O_RDONLY);
+       if (srcfd == -1) {
+               fprintf(stderr, "%s: Can't open %s: %s\n",
+                       __func__, pkey_file, strerror(errno));
+               ret = -1;
+               goto err;
+       }
+
+       ret = fstat(srcfd, &pub_key);
+       if (ret == -1) {
+               fprintf(stderr, "%s: Can't stat %s: %s\n",
+                       __func__, pkey_file, strerror(errno));
+               ret = -1;
+               goto err;
+       }
+
+       src_size = pub_key.st_size;
+
+       /* mmap the public key esl file */
+       sptr = mmap(0, src_size, PROT_READ, MAP_SHARED, srcfd, 0);
+       if (sptr == MAP_FAILED) {
+               fprintf(stderr, "%s: Failed to mmap %s:%s\n",
+                       __func__, pkey_file, strerror(errno));
+               ret = -1;
+               goto err;
+       }
+
+       /* Open the dest FDT */
+       destfd = open(dtb_file, O_RDWR);
+       if (destfd == -1) {
+               fprintf(stderr, "%s: Can't open %s: %s\n",
+                       __func__, dtb_file, strerror(errno));
+               ret = -1;
+               goto err;
+       }
+
+       ret = fstat(destfd, &dtb);
+       if (ret == -1) {
+               fprintf(stderr, "%s: Can't stat %s: %s\n",
+                       __func__, dtb_file, strerror(errno));
+               goto err;
+       }
+
+       dtb.st_size += src_size + 0x30;
+       if (ftruncate(destfd, dtb.st_size)) {
+               fprintf(stderr, "%s: Can't expand %s: %s\n",
+                       __func__, dtb_file, strerror(errno));
+               ret = -1;
+               goto err;
+       }
+
+       errno = 0;
+       /* mmap the dtb file */
+       dptr = mmap(0, dtb.st_size, PROT_READ | PROT_WRITE, MAP_SHARED,
+                   destfd, 0);
+       if (dptr == MAP_FAILED) {
+               fprintf(stderr, "%s: Failed to mmap %s:%s\n",
+                       __func__, dtb_file, strerror(errno));
+               ret = -1;
+               goto err;
+       }
+
+       if (fdt_check_header(dptr)) {
+               fprintf(stderr, "%s: Invalid FDT header\n", __func__);
+               ret = -1;
+               goto err;
+       }
+
+       ret = fdt_open_into(dptr, dptr, dtb.st_size);
+       if (ret) {
+               fprintf(stderr, "%s: Cannot expand FDT: %s\n",
+                       __func__, fdt_strerror(ret));
+               ret = -1;
+               goto err;
+       }
+
+       /* Copy the esl file to the expanded FDT */
+       ret = fdt_add_pub_key_data(sptr, dptr, src_size, overlay);
+       if (ret < 0) {
+               fprintf(stderr, "%s: Unable to add public key to the FDT\n",
+                       __func__);
+               ret = -1;
+               goto err;
+       }
+
+       ret = 0;
+
+err:
+       if (sptr)
+               munmap(sptr, src_size);
+
+       if (dptr)
+               munmap(dptr, dtb.st_size);
+
+       if (srcfd != -1)
+               close(srcfd);
+
+       if (destfd != -1)
+               close(destfd);
+
+       return ret;
+}
+
+int main(int argc, char **argv)
+{
+       char *pkey_file;
+       char *dtb_file;
+       bool overlay;
+       int c, idx, ret;
+
+       pkey_file = NULL;
+       dtb_file = NULL;
+       overlay = false;
+
+       for (;;) {
+               c = getopt_long(argc, argv, opts_short, options, &idx);
+               if (c == -1)
+                       break;
+
+               switch (c) {
+               case 'K':
+                       if (pkey_file) {
+                               printf("Public Key already specified\n");
+                               return -1;
+                       }
+                       pkey_file = optarg;
+                       break;
+               case 'D':
+                       if (dtb_file) {
+                               printf("DTB file already specified\n");
+                               return -1;
+                       }
+                       dtb_file = optarg;
+                       break;
+               case 'O':
+                       overlay = true;
+                       break;
+               case 'h':
+                       print_usage();
+                       return 0;
+               }
+       }
+
+       /* check necessary parameters */
+       if (!pkey_file || !dtb_file) {
+               print_usage();
+               exit(EXIT_FAILURE);
+       }
+
+       ret = add_public_key(pkey_file, dtb_file, overlay);
+       if (ret == -1) {
+               printf("Adding public key to the dtb failed\n");
+               exit(EXIT_FAILURE);
+       }
+
+       exit(EXIT_SUCCESS);
+}


Reply via email to