As we discussed, "-K" and "-D" options have nothing to do with
creating a capsule file. The same result can be obtained by
using standard commands like:
=== signature.dts ===
/dts-v1/;
/plugin/;
&{/} {
signature {
capsule-key = /incbin/("SIGNER.esl");
};
};
===
$ dtc -@ -I dts -O dtb -o signature.dtbo signature.dts
$ fdtoverlay -i test.dtb -o test_sig.dtb -v signature.dtbo
So just remove this feature.
(Effectively revert the commit 322c813f4bec ("mkeficapsule: Add support
for embedding public key in a dtb").)
The same feature is implemented by a shell script (tools/fdtsig.sh).
Signed-off-by: AKASHI Takahiro <[email protected]>
---
Makefile | 7 +-
tools/Makefile | 1 -
tools/fdtsig.sh | 40 ++++++++
tools/mkeficapsule.c | 235 ++-----------------------------------------
4 files changed, 50 insertions(+), 233 deletions(-)
create mode 100755 tools/fdtsig.sh
diff --git a/Makefile b/Makefile
index 63b1f0143220..9806464357e0 100644
--- a/Makefile
+++ b/Makefile
@@ -1015,9 +1015,8 @@ cmd_pad_cat = $(cmd_objcopy) && $(append) || { rm -f $@;
false; }
quiet_cmd_lzma = LZMA $@
cmd_lzma = lzma -c -z -k -9 $< > $@
-quiet_cmd_mkeficapsule = MKEFICAPSULE $@
-cmd_mkeficapsule = $(objtree)/tools/mkeficapsule -K $(CONFIG_EFI_PKEY_FILE) \
- -D $@
+quiet_cmd_fdtsig = FDTSIG $@
+cmd_fdtsig = $(srctree)/tools/fdtsig.sh $(CONFIG_EFI_PKEY_FILE) $@
cfg: u-boot.cfg
@@ -1114,7 +1113,7 @@ dtbs: dts/dt.dtb
ifeq ($(CONFIG_EFI_CAPSULE_AUTHENTICATE)$(CONFIG_EFI_PKEY_DTB_EMBED),yy)
dts/dt.dtb: u-boot tools
$(Q)$(MAKE) $(build)=dts dtbs
- $(call cmd,mkeficapsule)
+ $(call cmd,fdtsig)
else
dts/dt.dtb: u-boot
$(Q)$(MAKE) $(build)=dts dtbs
diff --git a/tools/Makefile b/tools/Makefile
index 02eae0286e20..71a52719620c 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -235,7 +235,6 @@ ifneq ($(CONFIG_EFI_CAPSULE_AUTHENTICATE),)
HOSTLDLIBS_mkeficapsule += \
$(shell pkg-config --libs libssl libcrypto 2> /dev/null || echo "-lssl
-lcrypto")
endif
-mkeficapsule-objs := mkeficapsule.o $(LIBFDT_OBJS)
hostprogs-$(CONFIG_EFI_HAVE_CAPSULE_SUPPORT) += mkeficapsule
# We build some files with extra pedantic flags to try to minimize things
diff --git a/tools/fdtsig.sh b/tools/fdtsig.sh
new file mode 100755
index 000000000000..aaa0a9190845
--- /dev/null
+++ b/tools/fdtsig.sh
@@ -0,0 +1,40 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0+
+#
+# script to add a certificate (efi-signature-list) to dtb blob
+
+usage() {
+ if [ -n "$*" ]; then
+ echo "ERROR: $*"
+ fi
+ echo "Usage: "$(basename $0) " <esl file> <dtb file>"
+}
+
+if [ "$#" -ne 2 ]; then
+ usage "Arguments missing"
+ exit 1
+fi
+
+ESL=$1
+DTB=$2
+NEW_DTB=$(basename $DTB)_tmp
+SIG=signature
+
+cat << 'EOF' > $SIG.dts
+/dts-v1/;
+/plugin/;
+
+&{/} {
+ signature {
+ capsule-key = /incbin/("ESL");
+ };
+};
+EOF
+
+sed -in "s/ESL/$ESL/" $SIG.dts
+
+dtc -@ -I dts -O dtb -o $SIG.dtbo $SIG.dts
+fdtoverlay -i $DTB -o $NEW_DTB -v $SIG.dtbo
+mv $NEW_DTB $DTB
+
+rm $SIG.dts $SIG.dtbo $NEW_DTB
diff --git a/tools/mkeficapsule.c b/tools/mkeficapsule.c
index 34ff1bdd82eb..97ce68ec83ee 100644
--- a/tools/mkeficapsule.c
+++ b/tools/mkeficapsule.c
@@ -4,17 +4,13 @@
* Author: AKASHI Takahiro
*/
-#include <errno.h>
#include <getopt.h>
#include <malloc.h>
#include <stdbool.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
-#include <unistd.h>
#include <linux/types.h>
-
-#include <sys/mman.h>
#include <sys/stat.h>
#include <sys/types.h>
@@ -28,8 +24,6 @@
#include <openssl/pkcs7.h>
#endif
-#include <linux/libfdt.h>
-
typedef __u8 u8;
typedef __u16 u16;
typedef __u32 u32;
@@ -39,9 +33,6 @@ typedef __s32 s32;
#define aligned_u64 __aligned_u64
-#define SIGNATURE_NODENAME "signature"
-#define OVERLAY_NODENAME "__overlay__"
-
#ifndef __packed
#define __packed __attribute__((packed))
#endif
@@ -59,9 +50,9 @@ efi_guid_t efi_guid_image_type_uboot_raw =
efi_guid_t efi_guid_cert_type_pkcs7 = EFI_CERT_TYPE_PKCS7_GUID;
#if IS_ENABLED(CONFIG_EFI_CAPSULE_AUTHENTICATE)
-static const char *opts_short = "f:r:i:I:v:D:K:P:C:m:dOh";
+static const char *opts_short = "f:r:i:I:v:P:C:m:dh";
#else
-static const char *opts_short = "f:r:i:I:v:D:K:Oh";
+static const char *opts_short = "f:r:i:I:v:h";
#endif
static struct option options[] = {
@@ -69,15 +60,12 @@ static struct option options[] = {
{"raw", required_argument, NULL, 'r'},
{"index", required_argument, NULL, 'i'},
{"instance", required_argument, NULL, 'I'},
- {"dtb", required_argument, NULL, 'D'},
- {"public key", required_argument, NULL, 'K'},
#if IS_ENABLED(CONFIG_EFI_CAPSULE_AUTHENTICATE)
{"private-key", required_argument, NULL, 'P'},
{"certificate", required_argument, NULL, 'C'},
{"monotonic-count", required_argument, NULL, 'm'},
{"dump-sig", no_argument, NULL, 'd'},
#endif
- {"overlay", no_argument, NULL, 'O'},
{"help", no_argument, NULL, 'h'},
{NULL, 0, NULL, 0},
};
@@ -104,180 +92,6 @@ static void print_usage(void)
tool_name);
}
-static int fdt_add_pub_key_data(void *sptr, void *dptr, size_t key_size,
- bool overlay)
-{
- int parent;
- int ov_node;
- int frag_node;
- int ret = 0;
-
- if (overlay) {
- /*
- * The signature would be stored in the
- * first fragment node of the overlay
- */
- frag_node = fdt_first_subnode(dptr, 0);
- if (frag_node == -FDT_ERR_NOTFOUND) {
- fprintf(stderr,
- "Couldn't find the fragment node: %s\n",
- fdt_strerror(frag_node));
- goto done;
- }
-
- ov_node = fdt_subnode_offset(dptr, frag_node, OVERLAY_NODENAME);
- if (ov_node == -FDT_ERR_NOTFOUND) {
- fprintf(stderr,
- "Couldn't find the __overlay__ node: %s\n",
- fdt_strerror(ov_node));
- goto done;
- }
- } else {
- ov_node = 0;
- }
-
- parent = fdt_subnode_offset(dptr, ov_node, SIGNATURE_NODENAME);
- if (parent == -FDT_ERR_NOTFOUND) {
- parent = fdt_add_subnode(dptr, ov_node, SIGNATURE_NODENAME);
- if (parent < 0) {
- ret = parent;
- if (ret != -FDT_ERR_NOSPACE) {
- fprintf(stderr,
- "Couldn't create signature node: %s\n",
- fdt_strerror(parent));
- }
- }
- }
- if (ret)
- goto done;
-
- /* Write the key to the FDT node */
- ret = fdt_setprop(dptr, parent, "capsule-key",
- sptr, key_size);
-
-done:
- if (ret)
- ret = ret == -FDT_ERR_NOSPACE ? -ENOSPC : -EIO;
-
- return ret;
-}
-
-static int add_public_key(const char *pkey_file, const char *dtb_file,
- bool overlay)
-{
- int ret;
- int srcfd = -1;
- int destfd = -1;
- void *sptr = NULL;
- void *dptr = NULL;
- off_t src_size;
- struct stat pub_key;
- struct stat dtb;
-
- /* Find out the size of the public key */
- srcfd = open(pkey_file, O_RDONLY);
- if (srcfd == -1) {
- fprintf(stderr, "%s: Can't open %s: %s\n",
- __func__, pkey_file, strerror(errno));
- ret = -1;
- goto err;
- }
-
- ret = fstat(srcfd, &pub_key);
- if (ret == -1) {
- fprintf(stderr, "%s: Can't stat %s: %s\n",
- __func__, pkey_file, strerror(errno));
- ret = -1;
- goto err;
- }
-
- src_size = pub_key.st_size;
-
- /* mmap the public key esl file */
- sptr = mmap(0, src_size, PROT_READ, MAP_SHARED, srcfd, 0);
- if (sptr == MAP_FAILED) {
- fprintf(stderr, "%s: Failed to mmap %s:%s\n",
- __func__, pkey_file, strerror(errno));
- ret = -1;
- goto err;
- }
-
- /* Open the dest FDT */
- destfd = open(dtb_file, O_RDWR);
- if (destfd == -1) {
- fprintf(stderr, "%s: Can't open %s: %s\n",
- __func__, dtb_file, strerror(errno));
- ret = -1;
- goto err;
- }
-
- ret = fstat(destfd, &dtb);
- if (ret == -1) {
- fprintf(stderr, "%s: Can't stat %s: %s\n",
- __func__, dtb_file, strerror(errno));
- goto err;
- }
-
- dtb.st_size += src_size + 0x30;
- if (ftruncate(destfd, dtb.st_size)) {
- fprintf(stderr, "%s: Can't expand %s: %s\n",
- __func__, dtb_file, strerror(errno));
- ret = -1;
- goto err;
- }
-
- errno = 0;
- /* mmap the dtb file */
- dptr = mmap(0, dtb.st_size, PROT_READ | PROT_WRITE, MAP_SHARED,
- destfd, 0);
- if (dptr == MAP_FAILED) {
- fprintf(stderr, "%s: Failed to mmap %s:%s\n",
- __func__, dtb_file, strerror(errno));
- ret = -1;
- goto err;
- }
-
- if (fdt_check_header(dptr)) {
- fprintf(stderr, "%s: Invalid FDT header\n", __func__);
- ret = -1;
- goto err;
- }
-
- ret = fdt_open_into(dptr, dptr, dtb.st_size);
- if (ret) {
- fprintf(stderr, "%s: Cannot expand FDT: %s\n",
- __func__, fdt_strerror(ret));
- ret = -1;
- goto err;
- }
-
- /* Copy the esl file to the expanded FDT */
- ret = fdt_add_pub_key_data(sptr, dptr, src_size, overlay);
- if (ret < 0) {
- fprintf(stderr, "%s: Unable to add public key to the FDT\n",
- __func__);
- ret = -1;
- goto err;
- }
-
- ret = 0;
-
-err:
- if (sptr)
- munmap(sptr, src_size);
-
- if (dptr)
- munmap(dptr, dtb.st_size);
-
- if (srcfd != -1)
- close(srcfd);
-
- if (destfd != -1)
- close(destfd);
-
- return ret;
-}
-
struct auth_context {
char *key_file;
char *cert_file;
@@ -608,19 +422,13 @@ err_1:
int main(int argc, char **argv)
{
char *file;
- char *pkey_file;
- char *dtb_file;
efi_guid_t *guid;
unsigned long index, instance;
uint64_t mcount;
char *privkey_file, *cert_file;
int c, idx;
- int ret;
- bool overlay = false;
file = NULL;
- pkey_file = NULL;
- dtb_file = NULL;
guid = NULL;
index = 0;
instance = 0;
@@ -656,20 +464,6 @@ int main(int argc, char **argv)
case 'I':
instance = strtoul(optarg, NULL, 0);
break;
- case 'K':
- if (pkey_file) {
- printf("Public Key already specified\n");
- return -1;
- }
- pkey_file = optarg;
- break;
- case 'D':
- if (dtb_file) {
- printf("DTB file already specified\n");
- return -1;
- }
- dtb_file = optarg;
- break;
#if IS_ENABLED(CONFIG_EFI_CAPSULE_AUTHENTICATE)
case 'P':
if (privkey_file) {
@@ -692,9 +486,6 @@ int main(int argc, char **argv)
dump_sig = 1;
break;
#endif
- case 'O':
- overlay = true;
- break;
case 'h':
print_usage();
return 0;
@@ -702,27 +493,15 @@ int main(int argc, char **argv)
}
/* check necessary parameters */
- if ((file && (!(optind < argc) ||
- (privkey_file && !cert_file) ||
- (!privkey_file && cert_file))) ||
- ((pkey_file && !dtb_file) ||
- (!pkey_file && dtb_file))) {
+ if (file && (!(optind < argc) ||
+ (privkey_file && !cert_file) ||
+ (!privkey_file && cert_file))) {
print_usage();
exit(EXIT_FAILURE);
}
- if (pkey_file && dtb_file) {
- ret = add_public_key(pkey_file, dtb_file, overlay);
- if (ret == -1) {
- printf("Adding public key to the dtb failed\n");
- exit(EXIT_FAILURE);
- }
- }
-
- if (optind < argc &&
- create_fwbin(argv[optind], file, guid, index, instance,
- mcount, privkey_file, cert_file)
- < 0) {
+ if (create_fwbin(argv[optind], file, guid, index, instance,
+ mcount, privkey_file, cert_file) < 0) {
printf("Creating firmware capsule failed\n");
exit(EXIT_FAILURE);
}
--
2.31.0
