mkeficapsule.c 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * Copyright 2018 Linaro Limited
  4. * Author: AKASHI Takahiro
  5. */
  6. #include <getopt.h>
  7. #include <pe.h>
  8. #include <stdbool.h>
  9. #include <stdint.h>
  10. #include <stdio.h>
  11. #include <stdlib.h>
  12. #include <string.h>
  13. #include <linux/types.h>
  14. #include <sys/stat.h>
  15. #include <sys/types.h>
  16. #include <uuid/uuid.h>
  17. #include <linux/kconfig.h>
  18. #include <gnutls/gnutls.h>
  19. #include <gnutls/pkcs7.h>
  20. #include <gnutls/abstract.h>
  21. #include "eficapsule.h"
  22. static const char *tool_name = "mkeficapsule";
  23. efi_guid_t efi_guid_fm_capsule = EFI_FIRMWARE_MANAGEMENT_CAPSULE_ID_GUID;
  24. efi_guid_t efi_guid_image_type_uboot_fit =
  25. EFI_FIRMWARE_IMAGE_TYPE_UBOOT_FIT_GUID;
  26. efi_guid_t efi_guid_image_type_uboot_raw =
  27. EFI_FIRMWARE_IMAGE_TYPE_UBOOT_RAW_GUID;
  28. efi_guid_t efi_guid_cert_type_pkcs7 = EFI_CERT_TYPE_PKCS7_GUID;
  29. static const char *opts_short = "frg:i:I:v:p:c:m:dh";
  30. static struct option options[] = {
  31. {"fit", no_argument, NULL, 'f'},
  32. {"raw", no_argument, NULL, 'r'},
  33. {"guid", required_argument, NULL, 'g'},
  34. {"index", required_argument, NULL, 'i'},
  35. {"instance", required_argument, NULL, 'I'},
  36. {"private-key", required_argument, NULL, 'p'},
  37. {"certificate", required_argument, NULL, 'c'},
  38. {"monotonic-count", required_argument, NULL, 'm'},
  39. {"dump-sig", no_argument, NULL, 'd'},
  40. {"help", no_argument, NULL, 'h'},
  41. {NULL, 0, NULL, 0},
  42. };
  43. static void print_usage(void)
  44. {
  45. fprintf(stderr, "Usage: %s [options] <image blob> <output file>\n"
  46. "Options:\n"
  47. "\t-f, --fit FIT image type\n"
  48. "\t-r, --raw raw image type\n"
  49. "\t-g, --guid <guid string> guid for image blob type\n"
  50. "\t-i, --index <index> update image index\n"
  51. "\t-I, --instance <instance> update hardware instance\n"
  52. "\t-p, --private-key <privkey file> private key file\n"
  53. "\t-c, --certificate <cert file> signer's certificate file\n"
  54. "\t-m, --monotonic-count <count> monotonic count\n"
  55. "\t-d, --dump_sig dump signature (*.p7)\n"
  56. "\t-h, --help print a help message\n",
  57. tool_name);
  58. }
  59. /**
  60. * auth_context - authentication context
  61. * @key_file: Path to a private key file
  62. * @cert_file: Path to a certificate file
  63. * @image_data: Pointer to firmware data
  64. * @image_size: Size of firmware data
  65. * @auth: Authentication header
  66. * @sig_data: Signature data
  67. * @sig_size: Size of signature data
  68. *
  69. * Data structure used in create_auth_data(). @key_file through
  70. * @image_size are input parameters. @auth, @sig_data and @sig_size
  71. * are filled in by create_auth_data().
  72. */
  73. struct auth_context {
  74. char *key_file;
  75. char *cert_file;
  76. uint8_t *image_data;
  77. size_t image_size;
  78. struct efi_firmware_image_authentication auth;
  79. uint8_t *sig_data;
  80. size_t sig_size;
  81. };
  82. static int dump_sig;
  83. /**
  84. * read_bin_file - read a firmware binary file
  85. * @bin: Path to a firmware binary file
  86. * @data: Pointer to pointer of allocated buffer
  87. * @bin_size: Size of allocated buffer
  88. *
  89. * Read out a content of binary, @bin, into @data.
  90. * A caller should free @data.
  91. *
  92. * Return:
  93. * * 0 - on success
  94. * * -1 - on failure
  95. */
  96. static int read_bin_file(char *bin, uint8_t **data, off_t *bin_size)
  97. {
  98. FILE *g;
  99. struct stat bin_stat;
  100. void *buf;
  101. size_t size;
  102. int ret = 0;
  103. g = fopen(bin, "r");
  104. if (!g) {
  105. fprintf(stderr, "cannot open %s\n", bin);
  106. return -1;
  107. }
  108. if (stat(bin, &bin_stat) < 0) {
  109. fprintf(stderr, "cannot determine the size of %s\n", bin);
  110. ret = -1;
  111. goto err;
  112. }
  113. if (bin_stat.st_size > SIZE_MAX) {
  114. fprintf(stderr, "file size is too large for malloc: %s\n", bin);
  115. ret = -1;
  116. goto err;
  117. }
  118. buf = malloc(bin_stat.st_size);
  119. if (!buf) {
  120. fprintf(stderr, "cannot allocate memory: %zx\n",
  121. (size_t)bin_stat.st_size);
  122. ret = -1;
  123. goto err;
  124. }
  125. size = fread(buf, 1, bin_stat.st_size, g);
  126. if (size < bin_stat.st_size) {
  127. fprintf(stderr, "read failed (%zx)\n", size);
  128. ret = -1;
  129. goto err;
  130. }
  131. *data = buf;
  132. *bin_size = bin_stat.st_size;
  133. err:
  134. fclose(g);
  135. return ret;
  136. }
  137. /**
  138. * write_capsule_file - write a capsule file
  139. * @bin: FILE stream
  140. * @data: Pointer to data
  141. * @bin_size: Size of data
  142. *
  143. * Write out data, @data, with the size @bin_size.
  144. *
  145. * Return:
  146. * * 0 - on success
  147. * * -1 - on failure
  148. */
  149. static int write_capsule_file(FILE *f, void *data, size_t size, const char *msg)
  150. {
  151. size_t size_written;
  152. size_written = fwrite(data, 1, size, f);
  153. if (size_written < size) {
  154. fprintf(stderr, "%s: write failed (%zx != %zx)\n", msg,
  155. size_written, size);
  156. return -1;
  157. }
  158. return 0;
  159. }
  160. /**
  161. * create_auth_data - compose authentication data in capsule
  162. * @auth_context: Pointer to authentication context
  163. *
  164. * Fill up an authentication header (.auth) and signature data (.sig_data)
  165. * in @auth_context, using library functions from openssl.
  166. * All the parameters in @auth_context must be filled in by a caller.
  167. *
  168. * Return:
  169. * * 0 - on success
  170. * * -1 - on failure
  171. */
  172. static int create_auth_data(struct auth_context *ctx)
  173. {
  174. gnutls_datum_t cert;
  175. gnutls_datum_t key;
  176. off_t file_size;
  177. gnutls_privkey_t pkey;
  178. gnutls_x509_crt_t x509;
  179. gnutls_pkcs7_t pkcs7;
  180. gnutls_datum_t data;
  181. gnutls_datum_t signature;
  182. int ret;
  183. ret = read_bin_file(ctx->cert_file, &cert.data, &file_size);
  184. if (ret < 0)
  185. return -1;
  186. if (file_size > UINT_MAX)
  187. return -1;
  188. cert.size = file_size;
  189. ret = read_bin_file(ctx->key_file, &key.data, &file_size);
  190. if (ret < 0)
  191. return -1;
  192. if (ret < 0)
  193. return -1;
  194. if (file_size > UINT_MAX)
  195. return -1;
  196. key.size = file_size;
  197. /*
  198. * For debugging,
  199. * gnutls_global_set_time_function(mytime);
  200. * gnutls_global_set_log_function(tls_log_func);
  201. * gnutls_global_set_log_level(6);
  202. */
  203. ret = gnutls_privkey_init(&pkey);
  204. if (ret < 0) {
  205. fprintf(stderr, "error in gnutls_privkey_init(): %s\n",
  206. gnutls_strerror(ret));
  207. return -1;
  208. }
  209. ret = gnutls_x509_crt_init(&x509);
  210. if (ret < 0) {
  211. fprintf(stderr, "error in gnutls_x509_crt_init(): %s\n",
  212. gnutls_strerror(ret));
  213. return -1;
  214. }
  215. /* load a private key */
  216. ret = gnutls_privkey_import_x509_raw(pkey, &key, GNUTLS_X509_FMT_PEM,
  217. 0, 0);
  218. if (ret < 0) {
  219. fprintf(stderr,
  220. "error in gnutls_privkey_import_x509_raw(): %s\n",
  221. gnutls_strerror(ret));
  222. return -1;
  223. }
  224. /* load x509 certificate */
  225. ret = gnutls_x509_crt_import(x509, &cert, GNUTLS_X509_FMT_PEM);
  226. if (ret < 0) {
  227. fprintf(stderr, "error in gnutls_x509_crt_import(): %s\n",
  228. gnutls_strerror(ret));
  229. return -1;
  230. }
  231. /* generate a PKCS #7 structure */
  232. ret = gnutls_pkcs7_init(&pkcs7);
  233. if (ret < 0) {
  234. fprintf(stderr, "error in gnutls_pkcs7_init(): %s\n",
  235. gnutls_strerror(ret));
  236. return -1;
  237. }
  238. /* sign */
  239. /*
  240. * Data should have
  241. * * firmware image
  242. * * monotonic count
  243. * in this order!
  244. * See EDK2's FmpAuthenticatedHandlerRsa2048Sha256()
  245. */
  246. data.size = ctx->image_size + sizeof(ctx->auth.monotonic_count);
  247. data.data = malloc(data.size);
  248. if (!data.data) {
  249. fprintf(stderr, "allocating memory (0x%x) failed\n", data.size);
  250. return -1;
  251. }
  252. memcpy(data.data, ctx->image_data, ctx->image_size);
  253. memcpy(data.data + ctx->image_size, &ctx->auth.monotonic_count,
  254. sizeof(ctx->auth.monotonic_count));
  255. ret = gnutls_pkcs7_sign(pkcs7, x509, pkey, &data, NULL, NULL,
  256. GNUTLS_DIG_SHA256,
  257. /* GNUTLS_PKCS7_EMBED_DATA? */
  258. GNUTLS_PKCS7_INCLUDE_CERT |
  259. GNUTLS_PKCS7_INCLUDE_TIME);
  260. if (ret < 0) {
  261. fprintf(stderr, "error in gnutls_pkcs7)sign(): %s\n",
  262. gnutls_strerror(ret));
  263. return -1;
  264. }
  265. /* export */
  266. ret = gnutls_pkcs7_export2(pkcs7, GNUTLS_X509_FMT_DER, &signature);
  267. if (ret < 0) {
  268. fprintf(stderr, "error in gnutls_pkcs7_export2: %s\n",
  269. gnutls_strerror(ret));
  270. return -1;
  271. }
  272. ctx->sig_data = signature.data;
  273. ctx->sig_size = signature.size;
  274. /* fill auth_info */
  275. ctx->auth.auth_info.hdr.dwLength = sizeof(ctx->auth.auth_info)
  276. + ctx->sig_size;
  277. ctx->auth.auth_info.hdr.wRevision = WIN_CERT_REVISION_2_0;
  278. ctx->auth.auth_info.hdr.wCertificateType = WIN_CERT_TYPE_EFI_GUID;
  279. memcpy(&ctx->auth.auth_info.cert_type, &efi_guid_cert_type_pkcs7,
  280. sizeof(efi_guid_cert_type_pkcs7));
  281. /*
  282. * For better clean-ups,
  283. * gnutls_pkcs7_deinit(pkcs7);
  284. * gnutls_privkey_deinit(pkey);
  285. * gnutls_x509_crt_deinit(x509);
  286. * free(cert.data);
  287. * free(key.data);
  288. * if error
  289. * gnutls_free(signature.data);
  290. */
  291. return 0;
  292. }
  293. /**
  294. * dump_signature - dump out a signature
  295. * @path: Path to a capsule file
  296. * @signature: Signature data
  297. * @sig_size: Size of signature data
  298. *
  299. * Signature data pointed to by @signature will be saved into
  300. * a file whose file name is @path with ".p7" suffix.
  301. *
  302. * Return:
  303. * * 0 - on success
  304. * * -1 - on failure
  305. */
  306. static int dump_signature(const char *path, uint8_t *signature, size_t sig_size)
  307. {
  308. char *sig_path;
  309. FILE *f;
  310. size_t size;
  311. int ret = -1;
  312. sig_path = malloc(strlen(path) + 3 + 1);
  313. if (!sig_path)
  314. return ret;
  315. sprintf(sig_path, "%s.p7", path);
  316. f = fopen(sig_path, "w");
  317. if (!f)
  318. goto err;
  319. size = fwrite(signature, 1, sig_size, f);
  320. if (size == sig_size)
  321. ret = 0;
  322. fclose(f);
  323. err:
  324. free(sig_path);
  325. return ret;
  326. }
  327. /**
  328. * free_sig_data - free out signature data
  329. * @ctx: Pointer to authentication context
  330. *
  331. * Free signature data allocated in create_auth_data().
  332. */
  333. static void free_sig_data(struct auth_context *ctx)
  334. {
  335. if (ctx->sig_size)
  336. gnutls_free(ctx->sig_data);
  337. }
  338. /**
  339. * create_fwbin - create an uefi capsule file
  340. * @path: Path to a created capsule file
  341. * @bin: Path to a firmware binary to encapsulate
  342. * @guid: GUID of related FMP driver
  343. * @index: Index number in capsule
  344. * @instance: Instance number in capsule
  345. * @mcount: Monotonic count in authentication information
  346. * @private_file: Path to a private key file
  347. * @cert_file: Path to a certificate file
  348. *
  349. * This function actually does the job of creating an uefi capsule file.
  350. * All the arguments must be supplied.
  351. * If either @private_file ror @cert_file is NULL, the capsule file
  352. * won't be signed.
  353. *
  354. * Return:
  355. * * 0 - on success
  356. * * -1 - on failure
  357. */
  358. static int create_fwbin(char *path, char *bin, efi_guid_t *guid,
  359. unsigned long index, unsigned long instance,
  360. uint64_t mcount, char *privkey_file, char *cert_file)
  361. {
  362. struct efi_capsule_header header;
  363. struct efi_firmware_management_capsule_header capsule;
  364. struct efi_firmware_management_capsule_image_header image;
  365. struct auth_context auth_context;
  366. FILE *f;
  367. uint8_t *data;
  368. off_t bin_size;
  369. uint64_t offset;
  370. int ret;
  371. #ifdef DEBUG
  372. fprintf(stderr, "For output: %s\n", path);
  373. fprintf(stderr, "\tbin: %s\n\ttype: %pUl\n", bin, guid);
  374. fprintf(stderr, "\tindex: %lu\n\tinstance: %lu\n", index, instance);
  375. #endif
  376. auth_context.sig_size = 0;
  377. f = NULL;
  378. data = NULL;
  379. ret = -1;
  380. /*
  381. * read a firmware binary
  382. */
  383. if (read_bin_file(bin, &data, &bin_size))
  384. goto err;
  385. /* first, calculate signature to determine its size */
  386. if (privkey_file && cert_file) {
  387. auth_context.key_file = privkey_file;
  388. auth_context.cert_file = cert_file;
  389. auth_context.auth.monotonic_count = mcount;
  390. auth_context.image_data = data;
  391. auth_context.image_size = bin_size;
  392. if (create_auth_data(&auth_context)) {
  393. fprintf(stderr, "Signing firmware image failed\n");
  394. goto err;
  395. }
  396. if (dump_sig &&
  397. dump_signature(path, auth_context.sig_data,
  398. auth_context.sig_size)) {
  399. fprintf(stderr, "Creating signature file failed\n");
  400. goto err;
  401. }
  402. }
  403. /*
  404. * write a capsule file
  405. */
  406. f = fopen(path, "w");
  407. if (!f) {
  408. fprintf(stderr, "cannot open %s\n", path);
  409. goto err;
  410. }
  411. /*
  412. * capsule file header
  413. */
  414. header.capsule_guid = efi_guid_fm_capsule;
  415. header.header_size = sizeof(header);
  416. /* TODO: The current implementation ignores flags */
  417. header.flags = CAPSULE_FLAGS_PERSIST_ACROSS_RESET;
  418. header.capsule_image_size = sizeof(header)
  419. + sizeof(capsule) + sizeof(uint64_t)
  420. + sizeof(image)
  421. + bin_size;
  422. if (auth_context.sig_size)
  423. header.capsule_image_size += sizeof(auth_context.auth)
  424. + auth_context.sig_size;
  425. if (write_capsule_file(f, &header, sizeof(header),
  426. "Capsule header"))
  427. goto err;
  428. /*
  429. * firmware capsule header
  430. * This capsule has only one firmware capsule image.
  431. */
  432. capsule.version = 0x00000001;
  433. capsule.embedded_driver_count = 0;
  434. capsule.payload_item_count = 1;
  435. if (write_capsule_file(f, &capsule, sizeof(capsule),
  436. "Firmware capsule header"))
  437. goto err;
  438. offset = sizeof(capsule) + sizeof(uint64_t);
  439. if (write_capsule_file(f, &offset, sizeof(offset),
  440. "Offset to capsule image"))
  441. goto err;
  442. /*
  443. * firmware capsule image header
  444. */
  445. image.version = 0x00000003;
  446. memcpy(&image.update_image_type_id, guid, sizeof(*guid));
  447. image.update_image_index = index;
  448. image.reserved[0] = 0;
  449. image.reserved[1] = 0;
  450. image.reserved[2] = 0;
  451. image.update_image_size = bin_size;
  452. if (auth_context.sig_size)
  453. image.update_image_size += sizeof(auth_context.auth)
  454. + auth_context.sig_size;
  455. image.update_vendor_code_size = 0; /* none */
  456. image.update_hardware_instance = instance;
  457. image.image_capsule_support = 0;
  458. if (auth_context.sig_size)
  459. image.image_capsule_support |= CAPSULE_SUPPORT_AUTHENTICATION;
  460. if (write_capsule_file(f, &image, sizeof(image),
  461. "Firmware capsule image header"))
  462. goto err;
  463. /*
  464. * signature
  465. */
  466. if (auth_context.sig_size) {
  467. if (write_capsule_file(f, &auth_context.auth,
  468. sizeof(auth_context.auth),
  469. "Authentication header"))
  470. goto err;
  471. if (write_capsule_file(f, auth_context.sig_data,
  472. auth_context.sig_size, "Signature"))
  473. goto err;
  474. }
  475. /*
  476. * firmware binary
  477. */
  478. if (write_capsule_file(f, data, bin_size, "Firmware binary"))
  479. goto err;
  480. ret = 0;
  481. err:
  482. if (f)
  483. fclose(f);
  484. free_sig_data(&auth_context);
  485. free(data);
  486. return ret;
  487. }
  488. /**
  489. * convert_uuid_to_guid() - convert UUID to GUID
  490. * @buf: UUID binary
  491. *
  492. * UUID and GUID have the same data structure, but their binary
  493. * formats are different due to the endianness. See lib/uuid.c.
  494. * Since uuid_parse() can handle only UUID, this function must
  495. * be called to get correct data for GUID when parsing a string.
  496. *
  497. * The correct data will be returned in @buf.
  498. */
  499. void convert_uuid_to_guid(unsigned char *buf)
  500. {
  501. unsigned char c;
  502. c = buf[0];
  503. buf[0] = buf[3];
  504. buf[3] = c;
  505. c = buf[1];
  506. buf[1] = buf[2];
  507. buf[2] = c;
  508. c = buf[4];
  509. buf[4] = buf[5];
  510. buf[5] = c;
  511. c = buf[6];
  512. buf[6] = buf[7];
  513. buf[7] = c;
  514. }
  515. /**
  516. * main - main entry function of mkeficapsule
  517. * @argc: Number of arguments
  518. * @argv: Array of pointers to arguments
  519. *
  520. * Create an uefi capsule file, optionally signing it.
  521. * Parse all the arguments and pass them on to create_fwbin().
  522. *
  523. * Return:
  524. * * 0 - on success
  525. * * -1 - on failure
  526. */
  527. int main(int argc, char **argv)
  528. {
  529. efi_guid_t *guid;
  530. unsigned char uuid_buf[16];
  531. unsigned long index, instance;
  532. uint64_t mcount;
  533. char *privkey_file, *cert_file;
  534. int c, idx;
  535. guid = NULL;
  536. index = 0;
  537. instance = 0;
  538. mcount = 0;
  539. privkey_file = NULL;
  540. cert_file = NULL;
  541. dump_sig = 0;
  542. for (;;) {
  543. c = getopt_long(argc, argv, opts_short, options, &idx);
  544. if (c == -1)
  545. break;
  546. switch (c) {
  547. case 'f':
  548. if (guid) {
  549. fprintf(stderr,
  550. "Image type already specified\n");
  551. exit(EXIT_FAILURE);
  552. }
  553. guid = &efi_guid_image_type_uboot_fit;
  554. break;
  555. case 'r':
  556. if (guid) {
  557. fprintf(stderr,
  558. "Image type already specified\n");
  559. exit(EXIT_FAILURE);
  560. }
  561. guid = &efi_guid_image_type_uboot_raw;
  562. break;
  563. case 'g':
  564. if (guid) {
  565. fprintf(stderr,
  566. "Image type already specified\n");
  567. exit(EXIT_FAILURE);
  568. }
  569. if (uuid_parse(optarg, uuid_buf)) {
  570. fprintf(stderr, "Wrong guid format\n");
  571. exit(EXIT_FAILURE);
  572. }
  573. convert_uuid_to_guid(uuid_buf);
  574. guid = (efi_guid_t *)uuid_buf;
  575. break;
  576. case 'i':
  577. index = strtoul(optarg, NULL, 0);
  578. break;
  579. case 'I':
  580. instance = strtoul(optarg, NULL, 0);
  581. break;
  582. case 'p':
  583. if (privkey_file) {
  584. fprintf(stderr,
  585. "Private Key already specified\n");
  586. exit(EXIT_FAILURE);
  587. }
  588. privkey_file = optarg;
  589. break;
  590. case 'c':
  591. if (cert_file) {
  592. fprintf(stderr,
  593. "Certificate file already specified\n");
  594. exit(EXIT_FAILURE);
  595. }
  596. cert_file = optarg;
  597. break;
  598. case 'm':
  599. mcount = strtoul(optarg, NULL, 0);
  600. break;
  601. case 'd':
  602. dump_sig = 1;
  603. break;
  604. case 'h':
  605. print_usage();
  606. exit(EXIT_SUCCESS);
  607. }
  608. }
  609. /* check necessary parameters */
  610. if ((argc != optind + 2) || !guid ||
  611. ((privkey_file && !cert_file) ||
  612. (!privkey_file && cert_file))) {
  613. print_usage();
  614. exit(EXIT_FAILURE);
  615. }
  616. if (create_fwbin(argv[argc - 1], argv[argc - 2], guid, index, instance,
  617. mcount, privkey_file, cert_file) < 0) {
  618. fprintf(stderr, "Creating firmware capsule failed\n");
  619. exit(EXIT_FAILURE);
  620. }
  621. exit(EXIT_SUCCESS);
  622. }