Commit graph

17 commits

Author SHA1 Message Date
AKASHI Takahiro
625d933edd tools: mkeficapsule: remove duplicated code
That code is mistakenly duplicated due to copy-and-paste error.
Just remove it.

Fixes: CID 348360
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2022-02-26 07:37:00 +01:00
AKASHI Takahiro
d9612f4426 tools: mkeficapsule: allow for specifying GUID explicitly
The existing options, "--fit" and "--raw," are only used to put a proper
GUID in a capsule header, where GUID identifies a particular FMP (Firmware
Management Protocol) driver which then would handle the firmware binary in
a capsule. In fact, mkeficapsule does the exact same job in creating
a capsule file whatever the firmware binary type is.

To prepare for the future extension, the command syntax will be a bit
modified to allow users to specify arbitrary GUID for their own FMP driver.
OLD:
   [--fit <image> | --raw <image>] <capsule file>
NEW:
   [--fit | --raw | --guid <guid-string>] <image> <capsule file>

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
2022-02-11 20:07:55 +01:00
AKASHI Takahiro
16abff246b tools: mkeficapsule: add firmware image signing
With this enhancement, mkeficapsule will be able to sign a capsule
file when it is created. A signature added will be used later
in the verification at FMP's SetImage() call.

To do that, we need specify additional command parameters:
  -monotonic-cout <count> : monotonic count
  -private-key <private key file> : private key file
  -certificate <certificate file> : certificate file
Only when all of those parameters are given, a signature will be added
to a capsule file.

Users are expected to maintain and increment the monotonic count at
every time of the update for each firmware image.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2022-02-11 20:07:55 +01:00
Heinrich Schuchardt
6bbe12f61c tools: mkeficapsule: dont use malloc.h
malloc() functions are declared via stdlib.h. Including  malloc.h can lead
to build errors e.g. on OS-X.

Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2022-02-05 20:20:01 +01:00
AKASHI Takahiro
9e63786e2b tools: mkeficapsule: rework the code a little bit
Abstract common routines to make the code easily understandable.
No functional change.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
2022-01-29 10:23:40 +01:00
AKASHI Takahiro
df1ce60fac tools: mkeficapsule: output messages to stderr instead of stdout
All the error messages should be printed out to stderr.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2022-01-29 10:23:40 +01:00
AKASHI Takahiro
18cfbbba1e Revert "Revert "mkeficapsule: Remove dtb related options""
This reverts commit d428e81266.
We have agreed with removing dtb-related stuff from mkeficapsule
command even if the commit 47a25e81d3 ("Revert "efi_capsule: Move
signature from DTB to .rodata"") was applied.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2021-10-25 21:13:06 +02:00
Simon Glass
d428e81266 Revert "mkeficapsule: Remove dtb related options"
This reverts commit f86caab058.

Signed-off-by: Simon Glass <sjg@chromium.org>
2021-09-18 03:46:56 -06:00
Ilias Apalodimas
f86caab058 mkeficapsule: Remove dtb related options
commit 322c813f4b ("mkeficapsule: Add support for embedding public key in a dtb")
added a bunch of options enabling the addition of the capsule public key
in a dtb.  Since now we embedded the key in U-Boot's .rodata we don't this
this functionality anymore

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2021-07-18 14:43:56 +02:00
Heinrich Schuchardt
2164063678 tools/mkeficapsule: improve online help
Show short arguments along with long arguments in online help:

    $ tools/mkeficapsule -h
    Usage: mkeficapsule [options] <output file>
    Options:
        -f, --fit <fit image>       new FIT image file
        -r, --raw <raw image>       new raw image file
        -i, --index <index>         update image index
        -I, --instance <instance>   update hardware instance
        -K, --public-key <key file> public key esl file
        -D, --dtb <dtb file>        dtb file
        -O, --overlay               the dtb file is an overlay
        -h, --help                  print a help message

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-04-10 12:00:24 +02:00
Simon Glass
ad09004ac4 mkeficapsule: Correct printf() strings
Use %z when printing size_t values. This avoids errors on 32-bit
machines.

Signed-off-by: Simon Glass <sjg@chromium.org>
Use a conversion to size_t for printing stat.st_size.
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-03-16 09:37:04 +01:00
Klaus Heinrich Kiwi
95cacc86f2 tools/mkeficapsule.c: fix DEBUG build
Fix a missing comma sign (,) from a printf(), that is only
reachable if DEBUG is defined, in which case the build fails with:

    tools/mkeficapsule.c:266:36: error: expected ‘)’ before ‘bin’
      266 |  printf("\tbin: %s\n\ttype: %pUl\n" bin, guid);
          |                                    ^~~~
          |                                    )

Signed-off-by: Klaus Heinrich Kiwi <klaus@linux.vnet.ibm.com>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-02-26 16:17:43 +01:00
Sughosh Ganu
d33f31816f mkeficapsule: Miscellaneous fixes in the utility
Miscellaneous fixes in the mkeficapsule utility -- these include a few
resource leak issues flagged by Coverity along with some additional
code improvements suggested by Heinrich during code review.

Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org>
2021-01-23 07:56:54 +01:00
AKASHI Takahiro
f7cd8b7b55 tools: mkeficapsule: fill reserved members of structure
Fill reserved members of efi_firmware_management_capsule_image_header
structure with zero's for safety.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Fixes: CID 316354
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-01-23 07:56:53 +01:00
Sughosh Ganu
322c813f4b mkeficapsule: Add support for embedding public key in a dtb
Add options for embedding the public key esl(efi signature list) file
to the platform's dtb. The esl file is then retrieved and used for
authenticating the capsule to be used for updating firmare components
on the platform.

The esl file can now be embedded in the dtb by invoking the following
command
mkeficapsule -K <pub_key.esl> -D <dtb>

In the scenario where the esl file is to be embedded in an overlay,
this can be done through the following command
mkeficapsule -O -K <pub_key.esl> -D <dtb>

This will create a node named 'signature' in the dtb, and the esl file
will be stored as 'capsule-key'

Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org>
2020-12-31 14:41:31 +01:00
AKASHI Takahiro
450596f2ac test/py: efi_capsule: test for FIT image capsule
The test can run on sandbox build and it attempts to execute a firmware
update via a capsule-on-disk, using a FIT image capsule,
CONFIG_EFI_CAPSULE_FIT.

To run this test successfully, you need configure U-Boot specifically;
See test_capsule_firmware.py for requirements, and hence it won't run
on Travis CI, at least, for now.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-12-03 21:22:50 +01:00
AKASHI Takahiro
fab430be2f tools: add mkeficapsule command for UEFI capsule update
This is a utility mainly for test purpose.
  mkeficapsule -f: create a test capsule file for FIT image firmware

Having said that, you will be able to customize the code to fit
your specific requirements for your platform.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-12-03 21:22:50 +01:00