[PATCH 3/4] tools: add fdtsig command

[AKASHI Takahiro <takahiro.akashi@linaro.org>]

On Thu, May 13, 2021 at 07:23:43AM +0200, Heinrich Schuchardt wrote:
> On 5/12/21 6:57 AM, AKASHI Takahiro wrote:
> > This command allows us to add a certificate (or public key) to dtb blob:
> > {
> > 	signature {
> > 		capsule-key = "...";
> > 	};
> > }
> > 
> > The value is actually a signature list in terms of UEFI specificaion,
> > and used in verifying UEFI capsules.
> > 
> > The code was originally developed by Sughosh and derived from
> > mkeficapsule.c.
> 
> I have no clue how you want to use this command. Please, provide a
> description of the workflow using this command.

Please read my patch carefully, in particular, Makefile.
In this patch, fdtsig.sh, which is introduced in Patch#2, is
replaced with fdtsig (C version).

I think that the workflow is trivial.

> In your comments for patch 2 you wrote that the -K and -D option can be
> replaced by tools provided by the device-tree compiler package. Why do
> they reappear here?

?
As I said, I don't intend to ask you to merge this patch.

In the cover letter,
! NOTE:
! I temporarily include Patch#3 in order to show that it is not worth
! implementing in C as we can do the same thing with a very small
! shell script.

Patch #1, #2 and #4 are just fine.

-Takahiro Akashi


> Please, add a man-page (/doc/fdtsig.1).
> 
> 
> > 
> > Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
> > ---
> >   Makefile       |   2 +-
> >   tools/Makefile |   2 +
> >   tools/fdtsig.c | 274 +++++++++++++++++++++++++++++++++++++++++++++++++
> >   3 files changed, 277 insertions(+), 1 deletion(-)
> >   create mode 100644 tools/fdtsig.c
> > 
> > diff --git a/Makefile b/Makefile
> > index 9806464357e0..8b40987234a0 100644
> > --- a/Makefile
> > +++ b/Makefile
> > @@ -1016,7 +1016,7 @@ quiet_cmd_lzma = LZMA    $@
> >   cmd_lzma = lzma -c -z -k -9 $< > $@
> > 
> >   quiet_cmd_fdtsig = FDTSIG  $@
> > -cmd_fdtsig = $(srctree)/tools/fdtsig.sh $(CONFIG_EFI_PKEY_FILE) $@
> > +cmd_fdtsig = $(objtree)/tools/fdtsig -K $(CONFIG_EFI_PKEY_FILE) -D $@
> > 
> >   cfg: u-boot.cfg
> > 
> > diff --git a/tools/Makefile b/tools/Makefile
> > index 71a52719620c..e6fd1dbade19 100644
> > --- a/tools/Makefile
> > +++ b/tools/Makefile
> > @@ -234,6 +234,8 @@ HOSTCFLAGS_asn1_compiler.o = -idirafter $(srctree)/include
> >   ifneq ($(CONFIG_EFI_CAPSULE_AUTHENTICATE),)
> >   HOSTLDLIBS_mkeficapsule += \
> >   	$(shell pkg-config --libs libssl libcrypto 2> /dev/null || echo "-lssl -lcrypto")
> > +	fdtsig-objs	:= fdtsig.o $(LIBFDT_OBJS)
> > +	hostprogs-y += fdtsig
> >   endif
> >   hostprogs-$(CONFIG_EFI_HAVE_CAPSULE_SUPPORT) += mkeficapsule
> > 
> > diff --git a/tools/fdtsig.c b/tools/fdtsig.c
> > new file mode 100644
> > index 000000000000..daa1e63c3b33
> > --- /dev/null
> > +++ b/tools/fdtsig.c
> > @@ -0,0 +1,274 @@
> > +// SPDX-License-Identifier: GPL-2.0
> > +/*
> > + * Copyright 2021 Linaro Limited
> > + * The code in this file was extracted from mkeficapsule.c
> 
> That information is better described by the git log.
> 
> Please, explain here what this tool is used for.
> 
> Best regards
> 
> Heinrich
> 
> > + */
> > +
> > +#include <errno.h>
> > +#include <fcntl.h>
> > +#include <getopt.h>
> > +#include <malloc.h>
> > +#include <stdbool.h>
> > +#include <stdio.h>
> > +#include <unistd.h>
> > +
> > +#include <sys/mman.h>
> > +#include <sys/stat.h>
> > +
> > +#include <linux/libfdt.h>
> > +
> > +#define SIGNATURE_NODENAME	"signature"
> > +#define OVERLAY_NODENAME	"__overlay__"
> > +
> > +static const char *tool_name = "fdtsig";
> > +
> > +static const char *opts_short = "D:K:Oh";
> > +
> > +static struct option options[] = {
> > +	{"dtb", required_argument, NULL, 'D'},
> > +	{"public key", required_argument, NULL, 'K'},
> > +	{"overlay", no_argument, NULL, 'O'},
> > +	{"help", no_argument, NULL, 'h'},
> > +	{NULL, 0, NULL, 0},
> > +};
> > +
> > +static void print_usage(void)
> > +{
> > +	printf("Usage: %s [options]\n"
> > +	       "Options:\n"
> > +
> > +	       "\t-K, --public-key <key file> public key esl file\n"
> > +	       "\t-D, --dtb <dtb file>        dtb file\n"
> > +	       "\t-O, --overlay               the dtb file is an overlay\n"
> > +	       "\t-h, --help                  print a help message\n",
> > +	       tool_name);
> > +}
> > +
> > +static int fdt_add_pub_key_data(void *sptr, void *dptr, size_t key_size,
> > +				bool overlay)
> > +{
> > +	int parent;
> > +	int ov_node;
> > +	int frag_node;
> > +	int ret = 0;
> > +
> > +	if (overlay) {
> > +		/*
> > +		 * The signature would be stored in the
> > +		 * first fragment node of the overlay
> > +		 */
> > +		frag_node = fdt_first_subnode(dptr, 0);
> > +		if (frag_node == -FDT_ERR_NOTFOUND) {
> > +			fprintf(stderr,
> > +				"Couldn't find the fragment node: %s\n",
> > +				fdt_strerror(frag_node));
> > +			goto done;
> > +		}
> > +
> > +		ov_node = fdt_subnode_offset(dptr, frag_node, OVERLAY_NODENAME);
> > +		if (ov_node == -FDT_ERR_NOTFOUND) {
> > +			fprintf(stderr,
> > +				"Couldn't find the __overlay__ node: %s\n",
> > +				fdt_strerror(ov_node));
> > +			goto done;
> > +		}
> > +	} else {
> > +		ov_node = 0;
> > +	}
> > +
> > +	parent = fdt_subnode_offset(dptr, ov_node, SIGNATURE_NODENAME);
> > +	if (parent == -FDT_ERR_NOTFOUND) {
> > +		parent = fdt_add_subnode(dptr, ov_node, SIGNATURE_NODENAME);
> > +		if (parent < 0) {
> > +			ret = parent;
> > +			if (ret != -FDT_ERR_NOSPACE) {
> > +				fprintf(stderr,
> > +					"Couldn't create signature node: %s\n",
> > +					fdt_strerror(parent));
> > +			}
> > +		}
> > +	}
> > +	if (ret)
> > +		goto done;
> > +
> > +	/* Write the key to the FDT node */
> > +	ret = fdt_setprop(dptr, parent, "capsule-key",
> > +			  sptr, key_size);
> > +
> > +done:
> > +	if (ret)
> > +		ret = ret == -FDT_ERR_NOSPACE ? -ENOSPC : -EIO;
> > +
> > +	return ret;
> > +}
> > +
> > +static int add_public_key(const char *pkey_file, const char *dtb_file,
> > +			  bool overlay)
> > +{
> > +	int ret;
> > +	int srcfd = -1;
> > +	int destfd = -1;
> > +	void *sptr = NULL;
> > +	void *dptr = NULL;
> > +	off_t src_size;
> > +	struct stat pub_key;
> > +	struct stat dtb;
> > +
> > +	/* Find out the size of the public key */
> > +	srcfd = open(pkey_file, O_RDONLY);
> > +	if (srcfd == -1) {
> > +		fprintf(stderr, "%s: Can't open %s: %s\n",
> > +			__func__, pkey_file, strerror(errno));
> > +		ret = -1;
> > +		goto err;
> > +	}
> > +
> > +	ret = fstat(srcfd, &pub_key);
> > +	if (ret == -1) {
> > +		fprintf(stderr, "%s: Can't stat %s: %s\n",
> > +			__func__, pkey_file, strerror(errno));
> > +		ret = -1;
> > +		goto err;
> > +	}
> > +
> > +	src_size = pub_key.st_size;
> > +
> > +	/* mmap the public key esl file */
> > +	sptr = mmap(0, src_size, PROT_READ, MAP_SHARED, srcfd, 0);
> > +	if (sptr == MAP_FAILED) {
> > +		fprintf(stderr, "%s: Failed to mmap %s:%s\n",
> > +			__func__, pkey_file, strerror(errno));
> > +		ret = -1;
> > +		goto err;
> > +	}
> > +
> > +	/* Open the dest FDT */
> > +	destfd = open(dtb_file, O_RDWR);
> > +	if (destfd == -1) {
> > +		fprintf(stderr, "%s: Can't open %s: %s\n",
> > +			__func__, dtb_file, strerror(errno));
> > +		ret = -1;
> > +		goto err;
> > +	}
> > +
> > +	ret = fstat(destfd, &dtb);
> > +	if (ret == -1) {
> > +		fprintf(stderr, "%s: Can't stat %s: %s\n",
> > +			__func__, dtb_file, strerror(errno));
> > +		goto err;
> > +	}
> > +
> > +	dtb.st_size += src_size + 0x30;
> > +	if (ftruncate(destfd, dtb.st_size)) {
> > +		fprintf(stderr, "%s: Can't expand %s: %s\n",
> > +			__func__, dtb_file, strerror(errno));
> > +		ret = -1;
> > +		goto err;
> > +	}
> > +
> > +	errno = 0;
> > +	/* mmap the dtb file */
> > +	dptr = mmap(0, dtb.st_size, PROT_READ | PROT_WRITE, MAP_SHARED,
> > +		    destfd, 0);
> > +	if (dptr == MAP_FAILED) {
> > +		fprintf(stderr, "%s: Failed to mmap %s:%s\n",
> > +			__func__, dtb_file, strerror(errno));
> > +		ret = -1;
> > +		goto err;
> > +	}
> > +
> > +	if (fdt_check_header(dptr)) {
> > +		fprintf(stderr, "%s: Invalid FDT header\n", __func__);
> > +		ret = -1;
> > +		goto err;
> > +	}
> > +
> > +	ret = fdt_open_into(dptr, dptr, dtb.st_size);
> > +	if (ret) {
> > +		fprintf(stderr, "%s: Cannot expand FDT: %s\n",
> > +			__func__, fdt_strerror(ret));
> > +		ret = -1;
> > +		goto err;
> > +	}
> > +
> > +	/* Copy the esl file to the expanded FDT */
> > +	ret = fdt_add_pub_key_data(sptr, dptr, src_size, overlay);
> > +	if (ret < 0) {
> > +		fprintf(stderr, "%s: Unable to add public key to the FDT\n",
> > +			__func__);
> > +		ret = -1;
> > +		goto err;
> > +	}
> > +
> > +	ret = 0;
> > +
> > +err:
> > +	if (sptr)
> > +		munmap(sptr, src_size);
> > +
> > +	if (dptr)
> > +		munmap(dptr, dtb.st_size);
> > +
> > +	if (srcfd != -1)
> > +		close(srcfd);
> > +
> > +	if (destfd != -1)
> > +		close(destfd);
> > +
> > +	return ret;
> > +}
> > +
> > +int main(int argc, char **argv)
> > +{
> > +	char *pkey_file;
> > +	char *dtb_file;
> > +	bool overlay;
> > +	int c, idx, ret;
> > +
> > +	pkey_file = NULL;
> > +	dtb_file = NULL;
> > +	overlay = false;
> > +
> > +	for (;;) {
> > +		c = getopt_long(argc, argv, opts_short, options, &idx);
> > +		if (c == -1)
> > +			break;
> > +
> > +		switch (c) {
> > +		case 'K':
> > +			if (pkey_file) {
> > +				printf("Public Key already specified\n");
> > +				return -1;
> > +			}
> > +			pkey_file = optarg;
> > +			break;
> > +		case 'D':
> > +			if (dtb_file) {
> > +				printf("DTB file already specified\n");
> > +				return -1;
> > +			}
> > +			dtb_file = optarg;
> > +			break;
> > +		case 'O':
> > +			overlay = true;
> > +			break;
> > +		case 'h':
> > +			print_usage();
> > +			return 0;
> > +		}
> > +	}
> > +
> > +	/* check necessary parameters */
> > +	if (!pkey_file || !dtb_file) {
> > +		print_usage();
> > +		exit(EXIT_FAILURE);
> > +	}
> > +
> > +	ret = add_public_key(pkey_file, dtb_file, overlay);
> > +	if (ret == -1) {
> > +		printf("Adding public key to the dtb failed\n");
> > +		exit(EXIT_FAILURE);
> > +	}
> > +
> > +	exit(EXIT_SUCCESS);
> > +}
> > 
>