From patchwork Tue Feb 11 09:49:14 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Rasmus Villemoes X-Patchwork-Id: 1236222 X-Patchwork-Delegate: trini@ti.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de (client-ip=85.214.62.61; helo=phobos.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=prevas.dk Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=prevas.dk header.i=@prevas.dk header.a=rsa-sha256 header.s=selector1 header.b=Jp9wlUmv; dkim-atps=neutral Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 48Gyfx0QXqz9s3x for ; Tue, 11 Feb 2020 20:49:45 +1100 (AEDT) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id BB5918105A; Tue, 11 Feb 2020 10:49:24 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=prevas.dk Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (1024-bit key; unprotected) header.d=prevas.dk header.i=@prevas.dk header.b="Jp9wlUmv"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 1EC2A80720; Tue, 11 Feb 2020 10:49:21 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=0.9 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU, FORGED_SPF_HELO, SPF_HELO_PASS, URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.2 Received: from EUR05-DB8-obe.outbound.protection.outlook.com (mail-db8eur05on2070d.outbound.protection.outlook.com [IPv6:2a01:111:f400:7e1a::70d]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 3D99080720 for ; Tue, 11 Feb 2020 10:49:16 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=prevas.dk Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=rasmus.villemoes@prevas.dk ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=hdxDasVUkhGfQgdxiU8OhbIcHMrpqhYPKeboMX3vPoRJFAy2ahIQ4w5Sy0AYzsMHfQ2v7rM+E7ychBcF95d7Bd2MvekCAKsrgSEEcrYyYqxh4rnDyoOkv4LZcRjtjtmwuqT4bNNpqcifB+a2Y/Mjl/1r0Dxq9WEh6SIye9B9wUwyKoADku7kr0AAP7UBTGr9l1bpeUj3+85gk25ED21nYW8Tkp50Qx1tQ/khUFPtSWVB9aRMC25lwO2ix32mziPYpYUpzakP0A7kkt4AfaMP1dM3ojXn4vKsO0Jfhij1MJoORvFjvd4QVbgVB6b5NJgL/EyREen9La4GR9uHgdbwtA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=KoyPjWW+rV7SmQJqvg438OhgA1UVR5gTSteCsvJuoQY=; b=ggNF/1hLeHvblTVeYQFI4H1NKnR7tXk/06NI3IYZuOWuoSOtfPn5BB4Yj8NTs5JzJZdtL+Yt/uIuI9veo67mWyxNWo5K+6vz0esWWny+QvQ4VEQddjaru2GF58184hccsyBOP0f89676vX5wz083jThfUyGtBIbULBzQsvq3vCaTFoXBddkNmR5dBpl8ceP1mSMppl9EKFBGVnIZvVCnVUVeshWSE931qhA+LzosJ0UVvVRkO3U3vGH2qG3LI+ZJqLynQebJ9P/Kp3/SIJohnBuesMNtSl309yE2v32JRiR3lMT4EnnU7XqA/z6UpoCl14QETbGPxWu9ppeT5AnWTQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=prevas.dk; dmarc=pass action=none header.from=prevas.dk; dkim=pass header.d=prevas.dk; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=prevas.dk; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=KoyPjWW+rV7SmQJqvg438OhgA1UVR5gTSteCsvJuoQY=; b=Jp9wlUmvHMh3OeiFV8ZvIFIkrGNkTcTJcYf4md7YJ12qEQrDiiIc53+wWGHpBIk9N70MJkKdH8l+HZEh/ShoDaBYqBnoeTAPUV5/tm4+ycQotcOEBcTurGV9gqC4ij7mnOSBI9jnyh6r6LKsYA6oyCMGdlHwC4u4dT253EWpJJw= Received: from VI1PR10MB2765.EURPRD10.PROD.OUTLOOK.COM (20.178.126.85) by VI1PR10MB2400.EURPRD10.PROD.OUTLOOK.COM (20.177.58.204) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2707.21; Tue, 11 Feb 2020 09:49:14 +0000 Received: from VI1PR10MB2765.EURPRD10.PROD.OUTLOOK.COM ([fe80::8175:5aa2:2870:766d]) by VI1PR10MB2765.EURPRD10.PROD.OUTLOOK.COM ([fe80::8175:5aa2:2870:766d%6]) with mapi id 15.20.2707.030; Tue, 11 Feb 2020 09:49:14 +0000 Received: from prevas-ravi.prevas.se (81.216.59.226) by HE1PR05CA0358.eurprd05.prod.outlook.com (2603:10a6:7:94::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2707.23 via Frontend Transport; Tue, 11 Feb 2020 09:49:14 +0000 From: Rasmus Villemoes To: "u-boot@lists.denx.de" Subject: [PATCH 2/3] tools: add fdt_add_pubkey Thread-Topic: [PATCH 2/3] tools: add fdt_add_pubkey Thread-Index: AQHV4MCF3mYUw7ooskCe9IQRD3gfDQ== Date: Tue, 11 Feb 2020 09:49:14 +0000 Message-ID: <20200211094818.14219-3-rasmus.villemoes@prevas.dk> References: <20200211094818.14219-1-rasmus.villemoes@prevas.dk> In-Reply-To: <20200211094818.14219-1-rasmus.villemoes@prevas.dk> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-clientproxiedby: HE1PR05CA0358.eurprd05.prod.outlook.com (2603:10a6:7:94::17) To VI1PR10MB2765.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:803:e1::21) x-mailer: git-send-email 2.23.0 authentication-results: spf=none (sender IP is ) smtp.mailfrom=rasmus.villemoes@prevas.dk; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [81.216.59.226] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 6ff3ae8d-da0c-42de-3515-08d7aed7a76f x-ms-traffictypediagnostic: VI1PR10MB2400: x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:644; x-forefront-prvs: 0310C78181 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(366004)(396003)(346002)(136003)(376002)(39850400004)(199004)(189003)(6486002)(71200400001)(36756003)(956004)(2616005)(44832011)(54906003)(478600001)(2906002)(6916009)(1076003)(186003)(16526019)(316002)(5660300002)(8676002)(8936002)(8976002)(81156014)(81166006)(26005)(6506007)(86362001)(4326008)(52116002)(107886003)(6512007)(64756008)(66476007)(66446008)(66946007)(66556008); DIR:OUT; SFP:1102; SCL:1; SRVR:VI1PR10MB2400; H:VI1PR10MB2765.EURPRD10.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: prevas.dk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: c22Yqti3kGbZLw4Ket7nT9drTuqDfb8INoiEhGcbx/K0d0GRu9pxZZ0CgvoTCMnsLcHd5mZlrb9HbNFrk6bckFGX1UmQ9IpGMsHsvi2LWrSyqqYdbqpmk+kHeeZsqAAjSD5TlTtSTytRGQ7sY+u9Pn+cM8Jwyrv4lTtf4zJvBfmjN8ItxNzq6PuKV8YLZjhgzcwiwbU2u2/ABw/Zo3WVCnqEeKp/CowggqqYrKrp+6eFDxu53swUEB/eMvBw/zxLi31v4wTqnz5M88x4RyT7xe6gXBW2fGlSkHAm9ap8tLpRjj6CBn9uWb6DnaFBEMv1Ngncuu+S7ImpwyafAWl1x0EbcjHIFUJ0MI7tdDvpkM352St4uKc6Y/kBtzsKgmsN8jCp2JoRn5wY7pKLhUm1QrO6km63I2XCSEuZm0jNTyDpo8q1AgG1NN+KTrfV+No3 x-ms-exchange-antispam-messagedata: +yINJOpc3JLtmXVbk6Hg/1e7dNxniHB6H8qS/pAFhTU1AJ1iy78BZDTm8ZCkgYar93kvTsUKB5f05ITpNK9UGOpc76k/1KNMIbDJlFcrg9Rm5kJsHlN2F6dGYwsN3iyiIAIb8Ps7IVts+05N8Yexmw== MIME-Version: 1.0 X-OriginatorOrg: prevas.dk X-MS-Exchange-CrossTenant-Network-Message-Id: 6ff3ae8d-da0c-42de-3515-08d7aed7a76f X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Feb 2020 09:49:14.7768 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: d350cf71-778d-4780-88f5-071a4cb1ed61 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: iJ1VjVnyJrMRzmx6lYpLuIgS6hpr1ToRjwPJkjOz3Z/BJ2REF5NJ5H756/3QTyWq1/F06pnPsakk9dBNRpoBsSvd56/bmTW5A8+1C6wFo/4= X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR10MB2400 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.26 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.102.1 at phobos.denx.de X-Virus-Status: Clean Having to use the -K option to mkimage to populate U-Boot's .dtb with the public key while signing the kernel FIT image is often a little awkward. In particular, when using a meta-build system such as bitbake/Yocto, having the tasks of the kernel and U-Boot recipes intertwined, modifying deployed artifacts and rebuilding U-Boot with an updated .dtb is quite cumbersome. Also, in some scenarios one may wish to build U-Boot complete with the public key(s) embedded in the .dtb without the corresponding private keys being present on the same build host. So this adds a simple tool that allows one to disentangle the kernel and U-Boot builds, by simply copy-pasting just enough of the mkimage code to allow one to add a public key to a .dtb. When using mkimage, some of the information is taken from the .its used to build the kernel (algorithm and key name), so that of course needs to be supplied on the command line. Signed-off-by: Rasmus Villemoes --- tools/.gitignore | 1 + tools/Makefile | 3 ++ tools/fdt_add_pubkey.c | 96 ++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 100 insertions(+) create mode 100644 tools/fdt_add_pubkey.c diff --git a/tools/.gitignore b/tools/.gitignore index 82bdce2782..a9894db853 100644 --- a/tools/.gitignore +++ b/tools/.gitignore @@ -6,6 +6,7 @@ /dumpimage /easylogo/easylogo /envcrc +/fdt_add_pubkey /fdtgrep /file2include /fit_check_sign diff --git a/tools/Makefile b/tools/Makefile index 345bc84e48..d91edeaddc 100644 --- a/tools/Makefile +++ b/tools/Makefile @@ -54,6 +54,7 @@ mkenvimage-objs := mkenvimage.o os_support.o lib/crc32.o hostprogs-y += dumpimage mkimage hostprogs-$(CONFIG_FIT_SIGNATURE) += fit_info fit_check_sign +hostprogs-$(CONFIG_FIT_SIGNATURE) += fdt_add_pubkey hostprogs-$(CONFIG_CMD_BOOTEFI_SELFTEST) += file2include @@ -122,6 +123,7 @@ dumpimage-objs := $(dumpimage-mkimage-objs) dumpimage.o mkimage-objs := $(dumpimage-mkimage-objs) mkimage.o fit_info-objs := $(dumpimage-mkimage-objs) fit_info.o fit_check_sign-objs := $(dumpimage-mkimage-objs) fit_check_sign.o +fdt_add_pubkey-objs := $(dumpimage-mkimage-objs) fdt_add_pubkey.o file2include-objs := file2include.o ifneq ($(CONFIG_MX23)$(CONFIG_MX28)$(CONFIG_FIT_SIGNATURE),) @@ -166,6 +168,7 @@ HOSTCFLAGS_fit_image.o += -DMKIMAGE_DTC=\"$(CONFIG_MKIMAGE_DTC_PATH)\" HOSTLOADLIBES_dumpimage := $(HOSTLOADLIBES_mkimage) HOSTLOADLIBES_fit_info := $(HOSTLOADLIBES_mkimage) HOSTLOADLIBES_fit_check_sign := $(HOSTLOADLIBES_mkimage) +HOSTLOADLIBES_fdt_add_pubkey := $(HOSTLOADLIBES_mkimage) hostprogs-$(CONFIG_EXYNOS5250) += mkexynosspl hostprogs-$(CONFIG_EXYNOS5420) += mkexynosspl diff --git a/tools/fdt_add_pubkey.c b/tools/fdt_add_pubkey.c new file mode 100644 index 0000000000..45a2ce9ad2 --- /dev/null +++ b/tools/fdt_add_pubkey.c @@ -0,0 +1,96 @@ +#include +#include "fit_common.h" + +static const char *cmdname; + +static const char *algo_name = "sha1,rsa2048"; /* -a */ +static const char *keydir = "."; /* -k */ +static const char *keyname = "key"; /* -n */ +static const char *require_keys; /* -r */ +static const char *keydest; /* argv[n] */ + +static void usage(const char *msg) +{ + fprintf(stderr, "Error: %s\n", msg); + fprintf(stderr, "Usage: %s [-a ] [-k ] [-n ] [-r ] \n", + cmdname); + exit(EXIT_FAILURE); +} + +static void process_args(int argc, char *argv[]) +{ + int opt; + + while((opt = getopt(argc, argv, "a:k:n:r:")) != -1) { + switch (opt) { + case 'k': + keydir = optarg; + break; + case 'a': + algo_name = optarg; + break; + case 'n': + keyname = optarg; + break; + case 'r': + require_keys = optarg; + break; + default: + usage("Invalid option"); + } + } + /* The last parameter is expected to be the .dtb to add the public key to */ + if (optind < argc) + keydest = argv[optind]; + + if (!keydest) + usage("Missing dtb file to update"); +} + +int main(int argc, char *argv[]) +{ + struct image_sign_info info; + int destfd, ret; + void *dest_blob = NULL; + struct stat dest_sbuf; + size_t size_inc = 0; + + cmdname = argv[0]; + + process_args(argc, argv); + + memset(&info, 0, sizeof(info)); + + info.keydir = keydir; + info.keyname = keyname; + info.name = algo_name; + info.require_keys = require_keys; + info.crypto = image_get_crypto_algo(algo_name); + if (!info.crypto) { + fprintf(stderr, "Unsupported signature algorithm '%s'\n", algo_name); + exit(EXIT_FAILURE); + } + + while (1) { + destfd = mmap_fdt(cmdname, keydest, size_inc, &dest_blob, &dest_sbuf, false, false); + if (destfd < 0) + exit(EXIT_FAILURE); + + ret = info.crypto->add_verify_data(&info, dest_blob); + + munmap(dest_blob, dest_sbuf.st_size); + close(destfd); + if (!ret || ret != -ENOSPC) + break; + fprintf(stderr, ".dtb too small, increasing size by 1024 bytes\n"); + size_inc = 1024; + } + + if (ret) { + fprintf(stderr, "%s: Cannot add public key to FIT blob: %s\n", + cmdname, strerror(-ret)); + exit(EXIT_FAILURE); + } + + exit(EXIT_SUCCESS); +}